CVE-2025-61662

gnu grub2

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-61662

Katalog CVE

CVSS 7.8 · High EPSS 0,20%

Kerentanan Use After Free pada gnu grub2. Skor CVSS 3.1 7.8 (High) menurut redhat.com.

Deskripsi (NVD)

A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.

Rincian

Terbit di NVD
18 November 2025
Terakhir diubah
1 September 2026
Status NVD
Modified
CVSS 3.1
7.8 (High), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-416: Use After Free
EPSS (30 hari)
0,20% peluang dieksploitasi; lebih tinggi dari 9,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
gnu grub2 Semua versi hingga 2.14

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.