CVE-2025-0622

MediumCVSS 6.4/10Last modified Oct 21, 2026

Description

A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2025
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-06247.6A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user c CVE-2025-06253.1A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part of CVE-2025-06267.5The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing devi CVE-2025-06273.5The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings,CVE-2025-06288.1An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewe CVE-2025-06294.8The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allo CVE-2025-06306.5Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authe CVE-2025-06318.7A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in c CVE-2025-06329.2Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensiti CVE-2025-06335.1Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory CVE-2025-06349.8Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.CVE-2025-06357.5Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resource