Skip to content
Fencer Vulns
medium 6.1

CVE-2025-0690 json

Grub2: read: integer overflow may lead to out-of-bounds write

published 2025-02-24 20 mo ago modified 2026-11-05 3 d ago also EUVD-2025-4377

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 9 1:2.06-104.el9_6
  • grub2 Debian 12 2.06-13+deb12u2
  • grub2 Debian 14, Debian 13 2.12-6

debian advisories DEBIAN-CVE-2025-0690

  • grub2 RHEL 9 1:2.06-104.el9_6
  • grub2-pc RHEL 9 1:2.06-104.el9_6
  • grub2-tools RHEL 9 1:2.06-104.el9_6
  • grub2-common RHEL 9 1:2.06-104.el9_6
  • grub2-efi-x64 RHEL 9 1:2.06-104.el9_6
  • grub2-ppc64le RHEL 9 1:2.06-104.el9_6
  • grub2-efi-aa64 RHEL 9 1:2.06-104.el9_6
  • grub2-tools-efi RHEL 9 1:2.06-104.el9_6

red hat advisories RHSA-2025:6990

  • grub2 Linux Micro 6.1 2.12-slfo.1.1_2.1
  • grub2 Linux Micro 6.0 2.12~rc1-6.1
  • grub2 SLE Micro 5.1 2.04-150300.3.11.1
  • grub2 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +2 more 2.04-150300.22.52.3
  • grub2 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +7 more 2.06-150400.11.55.2
  • grub2 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 2.06-150500.29.43.2
  • grub2 SLE Module for Server Applications 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.12-150600.8.18.2
  • grub2 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.02-181.2

suse advisories SUSE-SU-2025:20863-1SUSE-SU-2025:20511-1SUSE-SU-2025:01961-1SUSE-SU-2025:0629-1SUSE-SU-2025:0607-1SUSE-SU-2025:0588-1

  • grub2 openSUSE Tumbleweed 2.12-35.1

opensuse advisories openSUSE-SU-2025:14822-1

  • grub2-pc AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-tools AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-common AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-efi-x64 AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-ppc64le AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-efi-aa64 AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-tools-efi AlmaLinux 9 1:2.06-104.el9_6.alma.1
  • grub2-pc-modules AlmaLinux 9 1:2.06-104.el9_6.alma.1

almalinux advisories ALSA-2025:6990

  • grub2 Rocky Linux 9 1:2.06-104.el9_6

rocky linux advisories RLSA-2025:6990

  • grub2 Azure Linux 3.0 2.06-25
  • grub2 CBL-Mariner 2.0 2.06-15

azure linux advisories AZL-57150AZL-57159

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-0690 updated cvss 6.1

grub2: read: Integer overflow may lead to out-of-bounds write

  • Red Hat Enterprise Linux 7 grub2, grub2-pc, grub2-efi, grub2-ppc64, grub2-tools, grub2-common, +15 more Red Hat Enterprise Linux 8 grub2, grub2-pc, grub2-tools, grub2-common, grub2-efi-x64, grub2-ppc64le, +13 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux BaseOS (v. 9) grub2 2.06-104.el9_6, grub2-pc 2.06-104.el9_6, grub2-tools 2.06-104.el9_6, grub2-common 2.06-104.el9_6, grub2-efi-x64 2.06-104.el9_6, grub2-ppc64le 2.06-104.el9_6, +10 more
    fixed: vendor fix RHSA-2025:6990
  • Red Hat Enterprise Linux 10 grub2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.