CVE-2025-69650
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF...
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
- Record
CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE List
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
- Record
CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
EUVDEUVD-2025-208346
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
- Record
EUVD-2025-208346- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6m68-w836-p72w
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF...
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service.
- Record
GHSA-6m68-w836-p72w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSV
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
- Record
CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-69650
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
- Record
DEBIAN-CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2026:7098
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7098- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-322-CVE-2025-69650
CVE-2025-69650 in binutils - Patched by Root
Root has patched CVE-2025-69650 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-322-CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2025-69650
CVE-2025-69650 in binutils - Patched by Root
Root has patched CVE-2025-69650 in the binutils package for Root:Alpine:3.23. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-323-CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-324-CVE-2025-69650
CVE-2025-69650 in binutils - Patched by Root
Root has patched CVE-2025-69650 in the binutils package for Root:Alpine:3.24. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-324-CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-69650
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
- Record
UBUNTU-CVE-2025-69650- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-79562 No score
CVE-2025-69650 affecting package binutils 2.41-10
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service.
- Record
AZL-79562- Updated
- 2026-11-02
OSVAZL-79586 No score
CVE-2025-69650 affecting package binutils 2.37-20
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service.
- Record
AZL-79586- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsAzure Linux:3 |
through 2.41-10 | None known |
binutilsAzure Linux:2 |
through 2.37-20 | None known |
binutilsDebian:12 |
All versions, plus listed versions 2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1 Show 45 moreShow less2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1 |
None known |
binutilsDebian:13 |
All versions, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 43 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47.50.20260813-12.47.50.20260813-22.47.50.20260813-32.47.50.20260901-1 |
None known |
binutilsDebian:14 |
before 2.46-1, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 28 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-1 |
2.46-1 |
binutilsRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-develRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-goldRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutils-gprofngRed Hat:hummingbird:1 From an advisory covering 25 CVEs |
before 0:2.45.1-5.hum1 | 0:2.45.1-5.hum1 |
binutilsRoot:Alpine:3.22 |
before 2.44-r30072 | 2.44-r300722.44-r30073 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rootio-binutilsRoot:Alpine:3.22 |
before 2.44-r30072 | 2.44-r300722.44-r30073 |
binutilsRoot:Alpine:3.23 |
before 2.45.1-r00072 | 2.45.1-r000722.45.1-r00073 |
rootio-binutilsRoot:Alpine:3.23 |
before 2.45.1-r00072 | 2.45.1-r000722.45.1-r00073 |
binutilsRoot:Alpine:3.24 |
before 2.45.1-r10071 | 2.45.1-r100712.45.1-r100722.45.1-r100732.45.1-r10074 |
rootio-binutilsRoot:Alpine:3.24 |
before 2.45.1-r10071 | 2.45.1-r100712.45.1-r100722.45.1-r100732.45.1-r10074 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69650 is a high vulnerability (CVSS 7.5) in Gnu Binutils, published March 6, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in binutils 2.46-1.
References
sourceware.org/bugzilla/show_bug.cgi?id=33698
nvd.nist.gov/vuln/detail/CVE-2025-69650
Show 176 moreShow less
github.com/advisories/GHSA-6m68-w836-p72w
security-tracker.debian.org/tracker/CVE-2025-69650
access.redhat.com/errata/RHSA-2026:7098
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7098.json
bugzilla.redhat.com/show_bug.cgi?id=2399944
cve.org/CVERecord?id=CVE-2025-11081
vuldb.com?ctiid.326122
gnu.org
ubuntu.com/security/CVE-2025-69650
Left out here: 72 versions. The JSON record has them.