A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.
CVE-2025-1118
CVSS base score
4.4 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-501
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N