{"id":"CVE-2026-25828","aliases":["EUVD-2026-7371","GHSA-2fcc-cgw7-6rrw"],"status":"disputed","title":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS...","description":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports \"exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device.\"","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.01348,"percentile":0.71873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-02-12T00:00:00Z","modified":"2026-06-17T10:25:18Z","references":[{"url":"https://github.com/Antynea/grub-btrfs/tree/master"},{"url":"https://archlinux.org/packages/extra/any/grub-btrfs/"},{"url":"https://github.com/cardosource/CVE-2026-25828"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25828"},{"url":"https://archlinux.org/packages/extra/any/grub-btrfs"},{"url":"https://github.com/advisories/GHSA-2fcc-cgw7-6rrw"}],"sources":{"cve":[{"id":"CVE-2026-25828","description":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports \"exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device.\"","status":"disputed","published":"2026-02-12T00:00:00Z","modified":"2026-03-04T07:56:41.457Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-7371","description":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports \"exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device.\"","status":"published","published":"2026-02-12T00:00:00Z","modified":"2026-03-04T07:56:41Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:11.637968Z"}],"ghsa":[{"id":"GHSA-2fcc-cgw7-6rrw","title":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS...","description":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device().","status":"published","published":"2026-02-13T00:32:51Z","modified":"2026-02-13T21:34:09Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:06:13.022126Z"}],"nvd":[{"id":"CVE-2026-25828","description":"grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports \"exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device.\"","status":"disputed","published":"2026-02-12T22:16:05.493Z","modified":"2026-06-17T10:25:18.213Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:05.908608Z"}]}}