CVE-2025-54771: Grub2: use-after-free in grub_file_close()
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Other sources
Grub2: use-after-free in grubfileclose()
— Microsoft
When closing a file the grubfileclose() misses to dereference the filesystem structure leading to possible invalid reference to the file->fs->mod pointer. It may lead to a use-after-free vulnerability.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54771?
CVE-2025-54771 has been classified with a moderate severity due to the potential for exploitation by attackers.
How do I fix CVE-2025-54771?
To fix CVE-2025-54771, you need to apply the latest patches provided by the GNU GRUB maintainers.
What does CVE-2025-54771 affect?
CVE-2025-54771 specifically affects the GNU GRUB (Grand Unified Bootloader) software.
What kind of attack can exploit CVE-2025-54771?
An attacker could exploit CVE-2025-54771 to potentially execute malicious code due to the use-after-free vulnerability.
Is CVE-2025-54771 a common vulnerability?
CVE-2025-54771 is not considered common, but it poses a risk to systems using affected versions of GNU GRUB.