CVE-2025-61663
Last modified
CVE-2025-61663 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.
Metrics
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-61663?
How severe is CVE-2025-61663?
How do I fix CVE-2025-61663?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-61657Improper Neutralization of Input During Web Page Generation …0
- CVE-2025-61658Vulnerability in Wikimedia Foundation CheckUser. This vulner…4.3
- CVE-2025-61659bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp…6.8
- CVE-2025-6166A vulnerability was found in frdel Agent-Zero up to 0.8.4. I…5.1
- CVE-2025-61661A vulnerability has been identified in the GRUB (Grand Unifi…4.8
- CVE-2025-61662A Use-After-Free vulnerability has been discovered in GRUB's…7.8
- CVE-2025-61664A vulnerability in the GRUB2 bootloader has been identified …4.9
- CVE-2025-61665WeGIA is an open source web manager with a focus on charitab…7.5
- CVE-2025-61666Traccar is an open source GPS tracking system. Default insta…8.7
- CVE-2025-61667The Datadog Agent collects events and metrics from hosts and…7
- CVE-2025-61668Volto is a ReactJS-based frontend for the Plone Content Mana…8.7
- CVE-2025-61669Jupyter Server is the backend for Jupyter web applications. …6.1
Are you affected by CVE-2025-61663?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST