CVE-2025-0677

Summary

CVE-2025-0677 is a vulnerability affecting the grub2 bootloader's UFS module. The issue arises when grub fails to properly check the size of symlink data during a lookup, leading to an buffer allocation mismatch. Attackers can exploit this by crafting malicious symlinks that cause grub_malloc() to be called with an insufficient size. Subsequently, the grub_ufs_lookup_symlink() function attempts to read data beyond the allocated buffer, resulting in data corruption in the heap. This corruption can enable arbitrary code execution, potentially bypassing secure boot mechanisms.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.