A use-after-free vulnerability (CWE-416) exists in GNU grub2's gettext module due to a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker invoking this orphaned command can cause the application to access invalid memory, resulting in a crash and denial of service. The vulnerability carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating local attack vector with low complexity and low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Red Hat advisories RHSA-2026:10097 and RHSA-2026:14773 confirm fixes for this vulnerability in OpenShift Container Platform 4.16 and 4.15 respectively. The advisories instruct users to upgrade to the patched container images and RPM packages to remediate the issue.

Successful exploitation of this use-after-free vulnerability can cause grub2 to crash, resulting in denial of service. The CVSS vector indicates potential high impact on confidentiality, integrity, and availability, though the vendor advisory primarily confirms denial of service as the observed impact. There are no known exploits in the wild at this time. The vulnerability affects systems running vulnerable versions of grub2, particularly within Red Hat OpenShift Container Platform 4.15 and 4.16 environments.

Red Hat has released official fixes for this vulnerability in OpenShift Container Platform versions 4.15.64 and 4.16.60. Users should upgrade to these updated packages and container images as soon as they are available in their respective release channels. The vendor manages remediation for these cloud-hosted services via these updates. No additional mitigation steps are indicated beyond applying the official patches and updates. Patch status is confirmed by Red Hat advisories RHSA-2026:10097 and RHSA-2026:14773.