GNU grub2 udf grub_udf_read_block heap-based overflow

Summaryinfo

A vulnerability was found in GNU grub2. It has been rated as critical. This affects the function grub_udf_read_block of the component udf. The manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2025-0689. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in GNU grub2 (version unknown) and classified as critical. This issue affects the function grub_udf_read_block of the component udf. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always smaller than the allocated buffer size which is not guaranteed. A crafted filesystem image may lead to a heap-based buffer overflow resulting in critical data to be corrupted, resulting in the risk of arbitrary code execution by-passing secure boot protections.

The advisory is shared at bugzilla.redhat.com. The identification of this vulnerability is CVE-2025-0689 since 01/23/2025. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/08/2026).

The vulnerability scanner Nessus provides a plugin with the ID 216508 (SUSE SLES15 Security Update : grub2 (SUSE-SU-2025:0588-1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (216508) and EUVD (EUVD-2025-5596). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• GNU

Name

• grub2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion