CVE-2025-69649
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing...
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
CVE-2025-69649- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2025-208345
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
EUVD-2025-208345- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-63qm-v5pw-47h7
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing...
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
GHSA-63qm-v5pw-47h7- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVBELL-CVE-2025-69649
- Record
BELL-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
CVE-2025-69649- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2025-69649
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
DEBIAN-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:7098
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7098- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-319-CVE-2025-69649
CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.19. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-319-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-321-CVE-2025-69649
CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.21. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-321-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-322-CVE-2025-69649
CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-322-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2025-69649
CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.23. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-323-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-324-CVE-2025-69649
CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.24. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-324-CVE-2025-69649- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-69649
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
UBUNTU-CVE-2025-69649- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-79571 No score
CVE-2025-69649 affecting package binutils for versions less than 2.41-11
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
AZL-79571- Updated
- 2026-11-05
OSVAZL-79595 No score
CVE-2025-69649 affecting package binutils 2.37-20
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
- Record
AZL-79595- Updated
- 2026-11-02
OSVCLSA-2026-1773762013 No score
binutils: Fix of CVE-2025-69649
- CVE-2025-69649: null pointer dereference in readelf display_relocations()
- Record
CLSA-2026-1773762013- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11932-1 No score
binutils-2.47-1.1 on GA media
These are all security issues fixed in the binutils-2.47-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11932-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsAzure Linux:3 |
before 2.41-11 | 2.41-11 |
binutilsAzure Linux:2 |
through 2.37-20 | None known |
binutilsAlpaquita:25 |
2.44-r0 up to 2.45.1-r1 | 2.45.1-r1 |
binutilsAlpaquita:stream |
2.40-r4 up to 2.45.1-r3 | 2.45.1-r3 |
binutilsBellSoft Hardened Containers:25 |
2.44-r0 up to 2.45.1-r1 | 2.45.1-r1 |
binutilsBellSoft Hardened Containers:stream |
2.40-r4 up to 2.45.1-r3 | 2.45.1-r3 |
binutilsTuxCare:AlmaLinux:9.6 |
before 2.35.2-63.el9.tuxcare.els4 | 2.35.2-63.el9.tuxcare.els4 |
binutils-develTuxCare:AlmaLinux:9.6 |
before 2.35.2-63.el9.tuxcare.els4 | 2.35.2-63.el9.tuxcare.els4 |
binutils-goldTuxCare:AlmaLinux:9.6 |
before 2.35.2-63.el9.tuxcare.els4 | 2.35.2-63.el9.tuxcare.els4 |
cross-binutils-aarch64TuxCare:AlmaLinux:9.6 |
before 2.35.2-63.el9.tuxcare.els4 | 2.35.2-63.el9.tuxcare.els4 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cross-binutils-ppc64leTuxCare:AlmaLinux:9.6 |
before 2.35.2-63.el9.tuxcare.els4 | 2.35.2-63.el9.tuxcare.els4 |
cross-binutils-s390xTuxCare:AlmaLinux:9.6 |
before 2.35.2-63.el9.tuxcare.els4 | 2.35.2-63.el9.tuxcare.els4 |
binutilsDebian:12 |
All versions, plus listed versions 2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1 Show 45 moreShow less2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1 |
None known |
binutilsDebian:13 |
All versions, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 43 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47.50.20260813-12.47.50.20260813-22.47.50.20260813-32.47.50.20260901-1 |
None known |
binutilsDebian:14 |
before 2.46-1, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 28 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-1 |
2.46-1 |
binutilsRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-develRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-goldRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-gprofngRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutilsRoot:Alpine:3.19 |
before 2.41-r10071 | 2.41-r100712.41-r10072 |
rootio-binutilsRoot:Alpine:3.19 |
before 2.41-r10071 | 2.41-r100712.41-r10072 |
binutilsRoot:Alpine:3.21 |
before 2.43.1-r30072 | 2.43.1-r300722.43.1-r300712.43.1-r30073 |
rootio-binutilsRoot:Alpine:3.21 |
before 2.43.1-r30072 | 2.43.1-r300722.43.1-r300712.43.1-r30073 |
binutilsRoot:Alpine:3.22 |
before 2.44-r30071 | 2.44-r300712.44-r300722.44-r30073 |
rootio-binutilsRoot:Alpine:3.22 |
before 2.44-r30071 | 2.44-r300712.44-r300722.44-r30073 |
binutilsRoot:Alpine:3.23 |
before 2.45.1-r00071 | 2.45.1-r000712.45.1-r000722.45.1-r00073 |
rootio-binutilsRoot:Alpine:3.23 |
before 2.45.1-r00071 | 2.45.1-r000712.45.1-r000722.45.1-r00073 |
binutilsRoot:Alpine:3.24 |
before 2.45.1-r10072 | 2.45.1-r100722.45.1-r100732.45.1-r10074 |
rootio-binutilsRoot:Alpine:3.24 |
before 2.45.1-r10072 | 2.45.1-r100722.45.1-r100732.45.1-r10074 |
binutilsUbuntu:25.10 |
All versions, plus listed versions 2.44-3ubuntu12.44.50.20250602-0ubuntu12.44.50.20250604-0ubuntu22.44.50.20250616-0ubuntu12.44.50.20250707-1ubuntu1 Show 6 moreShow less2.45-1ubuntu12.45-3ubuntu32.45-6ubuntu12.45-7ubuntu12.45-7ubuntu1.12.45-7ubuntu1.2 |
None known |
binutilsopenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 2.47-1.1 | 2.47-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69649 is a high vulnerability (CVSS 7.5) in Gnu Binutils, published March 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in binutils 2.41-11.
References
sourceware.org/bugzilla/show_bug.cgi?id=33697
nvd.nist.gov/vuln/detail/CVE-2025-69649
github.com/advisories/GHSA-63qm-v5pw-47h7
docs.bell-sw.com/security/cves/CVE-2025-69649
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1773762013.html
Show 192 moreShow less
security-tracker.debian.org/tracker/CVE-2025-69649
access.redhat.com/errata/RHSA-2026:7098
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7098.json
bugzilla.redhat.com/show_bug.cgi?id=2399944
cve.org/CVERecord?id=CVE-2025-11081
vuldb.com?ctiid.326122
gnu.org
ubuntu.com/security/CVE-2025-69649
suse.com/security/cve/CVE-2025-11082
Left out here: 72 versions. The JSON record has them.