It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1342 advisory.

    A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command     is not properly unregistered when the network module is unloaded from memory. An attacker who can execute     this command can force the system to access memory locations that are no longer valid. Successful     exploitation leads directly to system instability, which can result in a complete crash and halt system     availability (CVE-2025-54770)

    A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw     occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference     to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading     to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
    (CVE-2025-54771)

    A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs     because the bootloader mishandles string conversion when reading information from a USB device, allowing     an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured     USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to     crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity     of the exploit the impact is most likely limited. (CVE-2025-61661)

    A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a     programming error where the gettext command remains registered in memory after its module is unloaded. An     attacker can exploit this condition by invoking the orphaned command, causing the application to access a     memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to     crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not     discarded. (CVE-2025-61662)

    A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate     Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is     not properly unregistered when the module is unloaded. An attacker who can execute this command can force     the system to access memory locations that are no longer valid. Successful exploitation leads directly to     system instability, which can result in a complete crash and halt system availability. Impact on the data     integrity and confidentiality is also not discarded. (CVE-2025-61663)

    A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use     After Free issue, occurs because the normal_exit command is not properly unregistered when its related     module is unloaded. An attacker can exploit this condition by invoking the command after the module has     been removed, causing the system to improperly access a previously freed memory location. This leads to a     system crash or possible impacts in data confidentiality and integrity. (CVE-2025-61664)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2025-1342)

high Nessus Plugin ID 282374

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Mar 17, 2026, 4:16 PM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2025-54771" to none) CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202603171616
Version 1.2 Feb 18, 2026, 9:24 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2025-61664" to "CVE-2025-61662") CVSSv2 severity (based on CVE-2025-61662, severity increased from "Low" to "Medium") CVSSv3 score source (changed from "CVE-2025-61662" to "CVE-2025-54771") Plugin Feed: 202602180924
Version 1.1 Jan 8, 2026, 1:54 PM New Plugin Feed: 202601081354