This vulnerability in GNU GRUB2 arises from improper handling of string conversion when reading information from USB devices during the boot process. The flaw allows inconsistent length values to be exploited by a local attacker who connects a specially crafted USB device during system startup. Successful exploitation can cause GRUB to crash, leading to denial of service, and may also cause data corruption. The CVSS 3.1 vector indicates the attack requires physical access (AV:P), high attack complexity (AC:H), no privileges (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and high availability impact (A:H). No known exploits are reported in the wild. The affected version is indicated as "=0" which likely means initial or unspecified versions. No patch or remediation details are provided in the vendor advisory.

Exploitation can cause the GRUB bootloader to crash, resulting in denial of service during system startup. There is also a potential for data corruption, though this is considered less likely. The vulnerability does not impact confidentiality but has low integrity and high availability impacts. The attack requires physical access to the machine to connect a malicious USB device during boot and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-61661 for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restricting physical access to systems during boot and disabling USB boot options where possible may reduce risk.