BaseFortify

Publication date: 2025-11-18

Last updated on: 2026-06-30

Assigner: Red Hat, Inc.

Description

A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2026-06-30

Generated

2026-07-07

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61661

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	grub	3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the GRUB bootloader due to improper handling of string conversion when reading data from a USB device. An attacker can exploit inconsistent length values by connecting a malicious USB device during the boot process, causing GRUB to crash or potentially corrupt data.

Impact Analysis

Exploitation of this vulnerability can cause the GRUB bootloader to crash, resulting in a Denial of Service (DoS). There is also a possibility of data corruption, although this is less likely due to the complexity of the exploit.

Hi! I’m here to help you understand CVE-2025-61661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70