Grub2: missing unregister call for gettext command may lead to use-after-free
Priority LOW 33CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix Fixed Red Hat: 21 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GNU | grub2 | up to 2.14 | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 1:2.12-29.el10_1.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 1:2.12-15.el10_0.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 1:2.02-0.87.el7_9.16 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1:2.02-170.el8_10.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 1:2.02-87.el8_2.14 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 1:2.02-99.el8_4.13 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | 1:2.02-99.el8_4.13 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 1:2.02-123.el8_6.19 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 1:2.02-123.el8_6.19 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 1:2.02-123.el8_6.19 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 1:2.02-152.el8_8.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 1:2.02-152.el8_8.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1:2.06-114.el9_7.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 1:2.06-27.el9_0.23 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 1:2.06-61.el9_2.11 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 1:2.06-86.el9_4.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | 1:2.06-105.el9_6.1 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 412.86.202604010116-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 413.92.202604080111-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 414.92.202605060243-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 415.92.202605060220-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 416.94.202604211449-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | 417.94.202605112123-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 418.94.202603181125-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 4.19.9.6.202604080618-0 | Patch available | CNA |
- grub2 VendorGNU Affected up to 2.14 Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1:2.12-29.el10_1.2 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1:2.12-15.el10_0.2 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1:2.02-0.87.el7_9.16 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1:2.02-170.el8_10.1 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1:2.02-87.el8_2.14 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1:2.02-99.el8_4.13 Patch available CNA
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 1:2.02-99.el8_4.13 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1:2.02-123.el8_6.19 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1:2.02-123.el8_6.19 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1:2.02-123.el8_6.19 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1:2.02-152.el8_8.3 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1:2.02-152.el8_8.3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1:2.06-114.el9_7.1 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1:2.06-27.el9_0.23 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1:2.06-61.el9_2.11 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 1:2.06-86.el9_4.4 Patch available CNA
- Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 1:2.06-105.el9_6.1 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 412.86.202604010116-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 413.92.202604080111-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 414.92.202605060243-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 415.92.202605060220-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 416.94.202604211449-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.17 VendorRed Hat Affected — Fixed in 417.94.202605112123-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 418.94.202603181125-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 4.19.9.6.202604080618-0 Patch available CNA
Remediation
Red Hat 21 advisories
- RHSA-2026:17596 Released 2026-05-20 · Red Hat rating ImportantOpenShift Container Platform 4.17.54 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202605112123-0, rhcos-ppc64le-417.94.202605112123-0, rhcos-s390x-417.94.202605112123-0 +1
- RHSA-2026:14773 Released 2026-05-13 · Red Hat rating ImportantOpenShift Container Platform 4.15.64 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202605060220-0, rhcos-ppc64le-415.92.202605060220-0, rhcos-s390x-415.92.202605060220-0 +1
- RHSA-2026:15087 Released 2026-05-13 · Red Hat rating ImportantOpenShift Container Platform 4.14.65 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202605060243-0, rhcos-ppc64le-414.92.202605060243-0, rhcos-s390x-414.92.202605060243-0 +1
Show 18 more Red Hat advisories
- RHSA-2026:10097 Released 2026-04-30 · Red Hat rating ImportantOpenShift Container Platform 4.16.60 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202604211449-0, rhcos-ppc64le-416.94.202604211449-0, rhcos-s390x-416.94.202604211449-0 +1
- RHSA-2026:7243 Released 2026-04-16 · Red Hat rating ImportantOpenShift Container Platform 4.19.28 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202604080618-0, rhcos-ppc64le-4.19.9.6.202604080618-0, rhcos-s390x-4.19.9.6.202604080618-0 +1
- RHSA-2026:7239 Released 2026-04-16 · Red Hat rating ImportantOpenShift Container Platform 4.13.65 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202604080111-0
- RHSA-2026:6492 Released 2026-04-09 · Red Hat rating ImportantOpenShift Container Platform 4.12.87 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202604010116-0
- RHSA-2026:5127 Released 2026-03-25 · Red Hat rating ModerateOpenShift Container Platform 4.18.36 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202603181125-0, rhcos-ppc64le-418.94.202603181125-0, rhcos-s390x-418.94.202603181125-0 +1
- RHSA-2026:5233 Released 2026-03-23 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) grub2-1:2.02-0.87.el7_9.16, grub2-common-1:2.02-0.87.el7_9.16, grub2-efi-ia32-1:2.02-0.87.el7_9.16 +12
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) grub2-efi-ia32-cdboot-1:2.02-0.87.el7_9.16, grub2-efi-ia32-modules-1:2.02-0.87.el7_9.16, grub2-efi-x64-cdboot-1:2.02-0.87.el7_9.16 +5
- RHSA-2026:5074 Released 2026-03-19 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) grub2-1:2.06-27.el9_0.23, grub2-common-1:2.06-27.el9_0.23, grub2-efi-aa64-1:2.06-27.el9_0.23 +13
- RHSA-2026:4998 Released 2026-03-18 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) grub2-1:2.02-87.el8_2.14, grub2-common-1:2.02-87.el8_2.14, grub2-efi-aa64-modules-1:2.02-87.el8_2.14 +13
- RHSA-2026:4900 Released 2026-03-18 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) grub2-1:2.06-61.el9_2.11, grub2-common-1:2.06-61.el9_2.11, grub2-efi-aa64-1:2.06-61.el9_2.11 +13
- RHSA-2026:4823 Released 2026-03-17 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) grub2-1:2.06-105.el9_6.1, grub2-common-1:2.06-105.el9_6.1, grub2-efi-aa64-1:2.06-105.el9_6.1 +13
- RHSA-2026:4822 Released 2026-03-17 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) grub2-1:2.06-86.el9_4.4, grub2-common-1:2.06-86.el9_4.4, grub2-efi-aa64-1:2.06-86.el9_4.4 +13
- RHSA-2026:4830 Released 2026-03-17 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) grub2-1:2.02-99.el8_4.13, grub2-common-1:2.02-99.el8_4.13, grub2-efi-aa64-modules-1:2.02-99.el8_4.13 +13
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) grub2-1:2.02-99.el8_4.13, grub2-common-1:2.02-99.el8_4.13, grub2-efi-aa64-modules-1:2.02-99.el8_4.13 +13
- RHSA-2026:4760 Released 2026-03-17 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS (v. 9) grub2-1:2.06-114.el9_7.1, grub2-common-1:2.06-114.el9_7.1, grub2-efi-aa64-1:2.06-114.el9_7.1 +13
- RHSA-2026:4654 Released 2026-03-16 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) grub2-1:2.02-123.el8_6.19, grub2-common-1:2.02-123.el8_6.19, grub2-efi-aa64-modules-1:2.02-123.el8_6.19 +13
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) grub2-1:2.02-123.el8_6.19, grub2-common-1:2.02-123.el8_6.19, grub2-efi-aa64-1:2.02-123.el8_6.19 +16
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) grub2-1:2.02-123.el8_6.19, grub2-common-1:2.02-123.el8_6.19, grub2-efi-aa64-modules-1:2.02-123.el8_6.19 +13
- RHSA-2026:4653 Released 2026-03-16 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) grub2-1:2.02-152.el8_8.3, grub2-common-1:2.02-152.el8_8.3, grub2-efi-aa64-modules-1:2.02-152.el8_8.3 +14
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) grub2-1:2.02-152.el8_8.3, grub2-common-1:2.02-152.el8_8.3, grub2-efi-aa64-modules-1:2.02-152.el8_8.3 +13
- RHSA-2026:4652 Released 2026-03-16 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) grub2-1:2.12-15.el10_0.2, grub2-common-1:2.12-15.el10_0.2, grub2-efi-aa64-1:2.12-15.el10_0.2 +13
- RHSA-2026:4648 Released 2026-03-16 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS (v. 8) grub2-1:2.02-170.el8_10.1, grub2-common-1:2.02-170.el8_10.1, grub2-efi-aa64-1:2.02-170.el8_10.1 +16
- RHSA-2026:4649 Released 2026-03-16 · Red Hat rating Moderategrub2 security update
- Red Hat Enterprise Linux BaseOS (v. 10) grub2-1:2.12-29.el10_1.2, grub2-common-1:2.12-29.el10_1.2, grub2-efi-aa64-1:2.12-29.el10_1.2 +13
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:4649 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:4648 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:4760 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2026:4998 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2026:4830 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2026:4654 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2026:4654 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2026:4653 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2026:5074 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2026:4900 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2026:4652 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2026:4822 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.6) | Fixed | RHSA-2026:4823 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:4830 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2026:4654 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2026:4653 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2026:5233 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2026:5233 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:6492 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:7239 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:15087 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:14773 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:10097 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:17596 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:5127 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:7243 |
Not affected: 4 products
- Red Hat Enterprise Linux BaseOS E4S (v.9.0)
- Red Hat Enterprise Linux BaseOS E4S (v.9.2)
- Red Hat Enterprise Linux BaseOS EUS (v.9.4)
- Red Hat Enterprise Linux BaseOS EUS (v.9.6)
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61662
- 2026-10-03 Alias added: GHSA-g7mr-vm94-3rv7
- 2026-10-16 Weakness changed · CNA
- 2026-10-16 Fix available: openshift/[email protected], openshift/[email protected], openshift/[email protected] +5 · CNA
- 2026-10-16 Affected versions changed · Red Hat
References
Advisory 23
- RHSA-2026:10097
- RHSA-2026:14773
- RHSA-2026:15087
- RHSA-2026:17596
- RHSA-2026:4648
- RHSA-2026:4649
- RHSA-2026:4652
- RHSA-2026:4653
- RHSA-2026:4654
- RHSA-2026:4760
- RHSA-2026:4822
- RHSA-2026:4823
- RHSA-2026:4830
- RHSA-2026:4900
- RHSA-2026:4998
- RHSA-2026:5074
- RHSA-2026:5127
- RHSA-2026:5233
- RHSA-2026:6492
- RHSA-2026:7239
- RHSA-2026:7243
- https://access.redhat.com/security/cve/CVE-2025-61662
- RHBZ#2414683
More GNU Grub2 vulnerabilities
- TI-2023-04324 Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution CVSS 3.1HIGH 7.8
- TI-2015-06891 Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate… CVSS 3.1HIGH 7.4
- TI-2024-37620 Heap-based buffer overflow in GNU GRUB2 CVSS 3.1HIGH 8.8
- TI-2022-11367 Integer underflow in GNU GRUB CVSS 3.1HIGH 8.1
- TI-2022-02403 Heap-based buffer overflow in grub2 CVSS 3.1HIGH 8.6
- TI-2020-08612 Buffer overflow in Grub CVSS 3.1HIGH 8.2
Sources
- CVE-2025-61662 · CVE Program
- CVE-2025-61662 · NVD
- FIRST EPSS
- GHSA-g7mr-vm94-3rv7 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-61662 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences