CVE-2025-69645
MediumCVSS 5.5Summary
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in handling DWARF compilation units can result in an invalid offset_size value being used in byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44, and a local attacker can trigger the crash by supplying a malicious input file.
Risk Assessment
A local attacker can trigger a crash of the objdump tool, potentially leading to denial of service or disruption of file analysis processes. This may disrupt developer tools and CI/CD pipelines.
Recommendation
Update binutils to a version containing the fix for this issue. Avoid processing untrusted binary files with objdump or do so in an isolated environment.
Other vulnerabilities in Binutils
See all- CVE-2026-6846High
A heap-buffer-overflow vulnerability was found in binutils when processing a specially crafted XCOFF object file during linking. A local attacker could trick a user into processing this malicious file, leading to arbitrary code execution or denial of service.
- CVE-2026-6845Medium
A flaw was found in binutils, specifically within the `readelf` utility, allowing a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted ELF file. Exploitation can lead to excessive resource consumption or a program crash, making the system unresponsive.
- CVE-2026-6844Medium
A flaw was found in the readelf utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted ELF file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the readelf utility becoming unresponsive or crashing.
- CVE-2020-35507Medium
A flaw exists in bfd_pef_parse_function_stubs of bfd/pef.c in binutils versions prior to 2.34. An attacker able to submit a crafted file processed by objdump can cause a NULL pointer dereference.
- CVE-2020-35496Medium
A flaw exists in bfd_pef_scan_start_address() of bfd/pef.c in binutils. An attacker able to submit a crafted file processed by objdump can cause a NULL pointer dereference.
- CVE-2020-35495Medium
A flaw exists in binutils /bfd/pef.c. An attacker able to submit a crafted input file processed by objdump can cause a NULL pointer dereference.
- CVE-2020-35494Medium
A flaw in binutils /opcodes/tic4x-dis.c causes the use of uninitialized memory when processing a crafted input file. The highest threat is to application availability, with a lower threat to data confidentiality. The flaw affects binutils versions prior to 2.34.
- CVE-2020-35493Medium
A heap buffer overflow exists in binutils in bfd/pef.c when a crafted PEF file is parsed by objdump, leading to an out-of-bounds read. The flaw affects binutils versions prior to 2.34.
Original NVD description (English source)
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS