CVE-2025-61664CWE-825

CVE-2025-61664

Medium · published November 19, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00150 · 3.8th percentile
Weakness
CWE-825 · Expired Pointer Dereference
Published
2025-11-19T00:15Z
References (3)
EPSS history
Timeline
  • 18 NOV 18:20Z
    Grub2: missing unregister call for normal_exit command may lead to use-after-free
    cvelistv5