CVE-2025-61664 Grub2: missing unregister call for normal_exit command may lead to use-after

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Grub2 Vulnerabilities Discovered Leading to Use-After-Free Issues Three vulnerabilities in Grub2 have been identified, each related to a missing unregister call for different commands: normal commands (CVE-2025-61663), normal_exit commands (CVE-2025-61664), and gettext commands (CVE-2025-61662). These vulnerabilities can lead to use-after-free conditions, potentially affecting systems utilizing Grub2 for boot management. 3 sources 39