GRUB2 (UFS symlink handling): Integer overflow on symlink handling in UFS gives a heap out-of-bounds write and a path

Impact

Integer overflow on symlink handling in UFS gives a heap out-of-bounds write and a path to loading unsigned code with Secure Boot on.

Who can reach it

Attacker-supplied UFS filesystem image.

What to do

grub2 package update + reboot.

References

Related entries

• GRUB2 (ReiserFS symlink handling): Same symlink integer-overflow pattern in the ReiserFS parserCVE-2025-0684 · GRUB2 (ReiserFS symlink handling)Medium
• GRUB2 (JFS symlink handling): Symlink integer overflow in the JFS parser producing a heap out-of-bounds writeCVE-2025-0685 · GRUB2 (JFS symlink handling)Medium
• GRUB2 (romfs symlink handling): Symlink integer overflow in the romfs parser producing a heap out-of-bounds writeCVE-2025-0686 · GRUB2 (romfs symlink handling)Medium
• GRUB2 (UDF filesystem parser): Heap buffer overflow in grub_udf_read_blockCVE-2025-0689 · GRUB2 (UDF filesystem parser)Medium
• GRUB2 (read command): Integer overflow in the read command's accumulator writes out of boundsCVE-2025-0690 · GRUB2 (read command)Medium
• GRUB2 (HFS filesystem parser): Integer overflow computing internal buffer sizes from HFS metadata, leading to a heapCVE-2025-1125 · GRUB2 (HFS filesystem parser)Medium