GNU GRUB2 vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20256
3. 20261

Newest CVEs

• CVE-2026-97876

  Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

  GNU · grub2

  Medium6.4
• CVE-2025-54770

  Grub2: use-after-free in net_set_vlan

  GNU · grub2

  Medium4.9
• CVE-2025-61664

  Grub2: missing unregister call for normal_exit command may lead to use-after-free

  GNU · grub2

  Medium4.9
• CVE-2025-61663

  Grub2: missing unregister call for normal commands may lead to use-after-free

  GNU · grub2

  Medium4.9
• CVE-2025-61662

  Grub2: missing unregister call for gettext command may lead to use-after-free

  GNU · grub2

  High7.8
• CVE-2025-61661

  Grub2: grub2: out-of-bounds write via malicious usb device

  GNU · grub2

  Medium4.8
• CVE-2025-54771

  Grub2: use-after-free in grub_file_close()

  GNU · grub2

  Medium4.9
• CVE-2024-56738

  GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.

  GNU · GRUB2

  Medium5.3
• CVE-2024-56737

  GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.

  GNU · GRUB2

  High8.8