CVE-2025-61664: Expired Pointer Dereference in GNU grub2
A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.
AI Analysis
Technical Summary
This vulnerability in GNU grub2 arises from a memory Use After Free condition in the normal module. The normal_exit command remains registered after its module is unloaded, allowing an attacker to invoke it and cause the system to access freed memory. This improper memory access can result in a system crash or compromise data confidentiality and integrity. The CVSS 3.1 score is 4.9 (medium), with attack vector local, high attack complexity, no privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can cause a system crash (denial of service) and may impact data confidentiality and integrity due to the use of freed memory. The impact is rated as medium severity with low confidentiality, integrity, and availability impacts according to CVSS.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory URL does not explicitly state a fix or workaround. Users should monitor the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-61664 for updates on patches or mitigations.
CVE-2025-61664: Expired Pointer Dereference in GNU grub2
Description
A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.
CVSS v3.1
Score 4.9medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in GNU grub2 arises from a memory Use After Free condition in the normal module. The normal_exit command remains registered after its module is unloaded, allowing an attacker to invoke it and cause the system to access freed memory. This improper memory access can result in a system crash or compromise data confidentiality and integrity. The CVSS 3.1 score is 4.9 (medium), with attack vector local, high attack complexity, no privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can cause a system crash (denial of service) and may impact data confidentiality and integrity due to the use of freed memory. The impact is rated as medium severity with low confidentiality, integrity, and availability impacts according to CVSS.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory URL does not explicitly state a fix or workaround. Users should monitor the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-61664 for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-09-29T20:18:48.976Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-61664","vendor":"Red Hat"}]
Threat ID: 691cbabbfcab56a016d7f80d
Added to database: 11/18/2025, 18:28:11 UTC
Last enriched: 07/02/2026, 22:04:36 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 214
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.