CVE-2025-0690
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in GRUB2 involves an integer overflow in a 32-bit variable tracking input length during keyboard read operations, leading to a heap-based buffer overflow. This can corrupt critical internal data within GRUB.
Risk Assessment
The risk includes potential bypass of Secure Boot by corrupting GRUB's internal data, which could allow execution of unauthorized code during the system boot process.
Recommendation
Immediately update GRUB2 to the latest patched version and apply security fixes provided by your operating system distribution.
Original NVD description (English source)
The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.