CVE-2025-0686

A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections.

• CWE-787

• https://access.redhat.com/security/cve/CVE-2025-0686Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2346121Issue Tracking
• https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

Published

Mar 3, 2025

Last Modified

Jun 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0680Affected products contain a vulnerability in the device clou…9.8
• CVE-2025-0681The Cloud MQTT service of the affected products supports wil…6.9
• CVE-2025-0682The ThemeREX Addons plugin for WordPress is vulnerable to Lo…8.8
• CVE-2025-0683In its default configuration, Contec Health CMS8000 Patient …8.2
• CVE-2025-0684A flaw was found in grub2. When performing a symlink lookup …6.4
• CVE-2025-0685A flaw was found in grub2. When reading data from a jfs file…6.4
• CVE-2025-0687The Spiritual Gifts Survey (and optional S.H.A.P.E survey) W…6.1
• CVE-2025-0688The Spiritual Gifts Survey (and optional S.H.A.P.E survey) W…6.1
• CVE-2025-0689When reading data from disk, the grub's UDF filesystem modul…7.8
• CVE-2025-0690The read command is used to read the keyboard input from the…6.1
• CVE-2025-0691Improper access control in permissions component in Devoluti…5
• CVE-2025-0692The Simple Video Management System WordPress plugin through …3.5