{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://git.savannah.gnu.org/git/grub.git","packageName":"grub2","product":"grub2","source":"CNA: redhat","vendor":"GNU","versions":[{"lessThanOrEqual":"2.14","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grub2","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grub2","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grub2","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grub2","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2025-61661","cwes":["CWE-131"],"description":"A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.","epss":{"date":"2026-11-05","percentile":0.1099,"score":0.00208},"exploits":[],"kev":null,"metrics":[{"score":4.8,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},{"score":4.8,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}],"modifiedAt":1793899037153,"publishedAt":1763490042151,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-61661"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413827"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2025/11/18/8"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2025-61661"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413827"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://www.openwall.com/lists/oss-security/2025/11/18/8"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"As a mitigation Red Hat doesn't recommend to connect untrusted or unknown USB devices to the machine."}],"revision":"2b4c3654c780b2db54404903754524918a2a1227e70c09df09ba978f8acd2175","sources":[{"modifiedAt":1793896498999,"name":"CNA: redhat","retrievedAt":1793898514875,"url":"https://www.cve.org/CVERecord?id=CVE-2025-61661"},{"modifiedAt":1793899037153,"name":"NVD","retrievedAt":1793902748009,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61661"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793898532657,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61661"}],"ssvc":{"assessedAt":1763561884440,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Grub2: grub2: out-of-bounds write via malicious usb device","updatedAt":1793902748009}