CVE-2025-1125
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In the GRUB HFS+ module, an integer overflow vulnerability occurs when calculating buffer sizes based on user-controlled filesystem metadata. This can lead to allocating a smaller buffer than needed and subsequent out-of-bounds write in the hfsplus_open_compressed_real() function.
Risk Assessment
An attacker could exploit this vulnerability to corrupt GRUB's internal critical data, potentially leading to arbitrary code execution and bypassing Secure Boot protections.
Recommendation
Immediately update GRUB to a patched version that fixes this vulnerability and re-sign the GRUB binaries for Secure Boot.
Other vulnerabilities in GRUB
See all- CVE-2022-2601High
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph.
- CVE-2025-61662High
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. The flaw occurs because the gettext command remains registered in memory after its module is unloaded. An attacker can invoke the orphaned command, causing access to an invalid memory location.
- CVE-2025-61661Medium
A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component due to improper string conversion when reading data from a USB device. A local attacker can connect a maliciously configured USB device during boot sequence, causing GRUB to crash and leading to a Denial of Service (DoS). Data corruption may also be possible, but due to exploit complexity the impact is likely limited.
- CVE-2025-4382Medium
In systems using LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption, an attacker with physical access can corrupt the filesystem superblock. This forces GRUB into rescue mode while the decryption key remains in memory, allowing access to unencrypted data without authentication.
- CVE-2024-45782High
A flaw was found in the HFS filesystem driver in GRUB. When mounting an HFS volume, grub_fs_mount() performs a strcpy() on the user-provided volume name without validating its length, leading to a heap-based out-of-bounds write. This issue compromises GRUB's sensitive data integrity and may allow bypassing Secure Boot protection.
- CVE-2025-0689High
A heap-based buffer overflow vulnerability in the UDF filesystem module of GRUB allows an attacker to bypass Secure Boot protections. By crafting a malicious filesystem image, arbitrary code execution can be achieved during the boot process.
Original NVD description (English source)
When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the hfsplus_open_compressed_real() function will write past of the internal buffer length. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections.