U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2025-0624 Detail

Description

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://access.redhat.com/errata/RHSA-2025:2521 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2653 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2655 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2675 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2784 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2799 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2867 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:2869 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3297 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3301 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3367 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3396 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3573 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3577 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:3780 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:4422 Red Hat, Inc.
https://access.redhat.com/errata/RHSA-2025:7702 Red Hat, Inc.
https://access.redhat.com/security/cve/CVE-2025-0624 Red Hat, Inc.
https://bugzilla.redhat.com/show_bug.cgi?id=2346112 Red Hat, Inc.
https://security.netapp.com/advisory/ntap-20250516-0006/ CVE

Weakness Enumeration

CWE-ID CWE Name Source
CWE-787 Out-of-bounds Write Red Hat, Inc.  

Change History

19 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2025-0624
NVD Published Date:
02/19/2025
NVD Last Modified:
05/21/2025
Source:
Red Hat, Inc.