CVE-2025-69645
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with...
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
CVE-2025-69645- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-208343
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
EUVD-2025-208343- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r62f-9x32-57f4
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with...
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
GHSA-r62f-9x32-57f4- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
CVE-2025-69645- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVBELL-CVE-2025-69645
- Record
BELL-CVE-2025-69645- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
CVE-2025-69645- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2025-69645
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
DEBIAN-CVE-2025-69645- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:7098
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7098- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-69645
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
UBUNTU-CVE-2025-69645- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-79568 No score
CVE-2025-69645 affecting package binutils for versions less than 2.41-11
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
AZL-79568- Updated
- 2026-11-05
OSVAZL-79592 No score
CVE-2025-69645 affecting package binutils 2.37-20
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
- Record
AZL-79592- Updated
- 2026-11-02
OSVCLSA-2026-1775726631 No score
binutils: Fix of 9 CVEs
- CVE-2023-1972: fix heap buffer overflow in _bfd_elf_slurp_version_tables
- CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry
- CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols
- CVE-2025-11839: fix abort in tg_tag_type with fuzzed input
- CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing
- CVE-2025-3198: fix memory leak in objdump display_info
- CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF
- CVE-2025-69652: fix abort in readelf from malformed DWARF debug info
- CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing
- Record
CLSA-2026-1775726631- Updated
- 2026-11-02
OSVCLSA-2026-1777949670 No score
binutils: Fix of 8 CVEs
- CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry
- CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols
- CVE-2025-11839: fix abort in tg_tag_type with fuzzed input
- CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing
- CVE-2025-3198: fix memory leak in objdump display_info
- CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing
- CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF
- CVE-2025-69652: fix abort in readelf from malformed DWARF debug info
- Record
CLSA-2026-1777949670- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11932-1 No score
binutils-2.47-1.1 on GA media
These are all security issues fixed in the binutils-2.47-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11932-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsAzure Linux:3 |
before 2.41-11 | 2.41-11 |
binutilsAzure Linux:2 |
through 2.37-20 | None known |
binutilsAlpaquita:25 |
2.44-r0 up to 2.45.1-r1 | 2.45.1-r1 |
binutilsAlpaquita:stream |
2.40-r4 up to 2.45.1-r3 | 2.45.1-r3 |
binutilsBellSoft Hardened Containers:25 |
2.44-r0 up to 2.45.1-r1 | 2.45.1-r1 |
binutilsBellSoft Hardened Containers:stream |
2.40-r4 up to 2.45.1-r3 | 2.45.1-r3 |
binutilsTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
binutils-develTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
binutils-goldTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
cross-binutils-aarch64TuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cross-binutils-ppc64leTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
cross-binutils-s390xTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
binutilsTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
binutils-develTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
binutils-goldTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
cross-binutils-aarch64TuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
cross-binutils-ppc64leTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
cross-binutils-s390xTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
binutilsDebian:12 |
All versions, plus listed versions 2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1 Show 45 moreShow less2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1 |
None known |
binutilsDebian:13 |
All versions, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 43 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47.50.20260813-12.47.50.20260813-22.47.50.20260813-32.47.50.20260901-1 |
None known |
binutilsDebian:14 |
before 2.46-1, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 28 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-1 |
2.46-1 |
binutilsRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-develRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-goldRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-gprofngRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutilsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.23.52.20130913-0ubuntu12.23.90.20131017-1ubuntu12.23.90.20131116-1ubuntu12.23.91.20131123-1ubuntu12.24-1ubuntu1 Show 20 moreShow less2.24-1ubuntu22.24-2ubuntu12.24-2ubuntu22.24-2ubuntu32.24-4ubuntu12.24-5ubuntu12.24-5ubuntu22.24-5ubuntu32.24-5ubuntu3.12.24-5ubuntu132.24-5ubuntu142.24-5ubuntu14.12.24-5ubuntu14.22.24-5ubuntu14.2+esm12.24-5ubuntu14.2+esm22.24-5ubuntu14.2+esm32.24-5ubuntu14.2+esm52.24-5ubuntu14.2+esm62.24-5ubuntu14.2+esm72.24-5ubuntu14.2+esm8 |
None known |
binutilsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.25.1-6ubuntu12.25.51.20151022-0ubuntu22.25.51.20151022-0ubuntu32.25.51.20151027-0ubuntu12.25.51.20151028-0ubuntu1 Show 37 moreShow less2.25.51.20151106-0ubuntu12.25.51.20151113-1ubuntu12.25.51.20151113-2ubuntu12.25.90.20151125-1ubuntu12.25.90.20151125-2ubuntu12.25.90.20151211-0ubuntu12.25.90.20151211-0ubuntu22.25.90.20160101-1ubuntu12.25.90.20160101-1ubuntu22.26-2ubuntu12.26-3ubuntu12.26-4ubuntu12.26-5ubuntu12.26-6ubuntu12.26-7ubuntu22.26-8ubuntu12.26-8ubuntu22.26-8ubuntu2.12.26.1-1ubuntu1~16.042.26.1-1ubuntu1~16.04.12.26.1-1ubuntu1~16.04.32.26.1-1ubuntu1~16.04.42.26.1-1ubuntu1~16.04.52.26.1-1ubuntu1~16.04.62.26.1-1ubuntu1~16.04.72.26.1-1ubuntu1~16.04.82.26.1-1ubuntu1~16.04.8+esm12.26.1-1ubuntu1~16.04.8+esm32.26.1-1ubuntu1~16.04.8+esm42.26.1-1ubuntu1~16.04.8+esm52.26.1-1ubuntu1~16.04.8+esm62.26.1-1ubuntu1~16.04.8+esm72.26.1-1ubuntu1~16.04.8+esm92.26.1-1ubuntu1~16.04.8+esm112.26.1-1ubuntu1~16.04.8+esm122.26.1-1ubuntu1~16.04.8+esm132.26.1-1ubuntu1~16.04.8+esm14 |
None known |
binutilsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.29.1-4ubuntu12.29.1-6ubuntu12.29.1-7ubuntu12.29.1-8ubuntu12.29.1-10ubuntu1 Show 25 moreShow less2.29.1-12ubuntu12.30-4ubuntu12.30-5ubuntu12.30-7ubuntu12.30-8ubuntu12.30-9ubuntu12.30-10ubuntu12.30-11ubuntu12.30-14ubuntu22.30-15ubuntu12.30-20ubuntu2~18.042.30-21ubuntu1~18.042.30-21ubuntu1~18.04.12.30-21ubuntu1~18.04.22.30-21ubuntu1~18.04.32.30-21ubuntu1~18.04.42.30-21ubuntu1~18.04.52.30-21ubuntu1~18.04.72.30-21ubuntu1~18.04.82.30-21ubuntu1~18.04.92.30-21ubuntu1~18.04.9+esm12.30-21ubuntu1~18.04.9+esm32.30-21ubuntu1~18.04.9+esm42.30-21ubuntu1~18.04.9+esm52.30-21ubuntu1~18.04.9+esm13 |
None known |
binutilsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.33-2ubuntu12.33.1-1ubuntu12.33.1-5ubuntu12.33.1-6ubuntu12.33.1-6ubuntu3 Show 18 moreShow less2.33.90.20200122-1ubuntu22.34-1ubuntu12.34-3ubuntu12.34-4ubuntu12.34-5ubuntu12.34-6ubuntu12.34-6ubuntu1.12.34-6ubuntu1.32.34-6ubuntu1.42.34-6ubuntu1.52.34-6ubuntu1.62.34-6ubuntu1.72.34-6ubuntu1.82.34-6ubuntu1.92.34-6ubuntu1.102.34-6ubuntu1.112.34-6ubuntu1.11+esm12.34-6ubuntu1.11+esm2 |
None known |
binutilsUbuntu:22.04:LTS |
All versions, plus listed versions 2.37-7ubuntu12.37-9ubuntu12.37-10ubuntu12.37.50.20220106-2ubuntu12.37.90.20220126-0ubuntu1 Show 16 moreShow less2.37.90.20220130-0ubuntu22.38-1ubuntu12.38-2ubuntu12.38-3ubuntu12.38-4ubuntu22.38-4ubuntu2.12.38-4ubuntu2.22.38-4ubuntu2.32.38-4ubuntu2.42.38-4ubuntu2.52.38-4ubuntu2.62.38-4ubuntu2.72.38-4ubuntu2.82.38-4ubuntu2.102.38-4ubuntu2.112.38-4ubuntu2.12 |
None known |
binutilsUbuntu:24.04:LTS |
All versions, plus listed versions 2.41-5ubuntu12.41-6ubuntu12.41.50.20231206-1ubuntu12.41.50.20231214-1ubuntu12.41.50.20231227-1ubuntu1 Show 12 moreShow less2.41.90.20240122-1ubuntu12.42-2ubuntu12.42-3ubuntu12.42-4ubuntu12.42-4ubuntu22.42-4ubuntu2.32.42-4ubuntu2.42.42-4ubuntu2.52.42-4ubuntu2.62.42-4ubuntu2.72.42-4ubuntu2.82.42-4ubuntu2.10 |
None known |
binutilsUbuntu:25.10 |
All versions, plus listed versions 2.44-3ubuntu12.44.50.20250602-0ubuntu12.44.50.20250604-0ubuntu22.44.50.20250616-0ubuntu12.44.50.20250707-1ubuntu1 Show 6 moreShow less2.45-1ubuntu12.45-3ubuntu32.45-6ubuntu12.45-7ubuntu12.45-7ubuntu1.12.45-7ubuntu1.2 |
None known |
binutilsopenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 2.47-1.1 | 2.47-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69645 is a medium vulnerability (CVSS 5.5) in Gnu Binutils, published March 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in binutils 2.41-11.
References
sourceware.org/bugzilla/show_bug.cgi?id=33637
nvd.nist.gov/vuln/detail/CVE-2025-69645
github.com/advisories/GHSA-r62f-9x32-57f4
docs.bell-sw.com/security/cves/CVE-2025-69645
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775726631.html
Show 193 moreShow less
security-tracker.debian.org/tracker/CVE-2025-69645
access.redhat.com/errata/RHSA-2026:7098
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7098.json
bugzilla.redhat.com/show_bug.cgi?id=2399944
cve.org/CVERecord?id=CVE-2025-11081
vuldb.com?ctiid.326122
gnu.org
ubuntu.com/security/CVE-2025-69645
suse.com/security/cve/CVE-2025-11082
Left out here: 72 versions. The JSON record has them.