CVE-2025-69646: Medium severity GNU binutils vulnerability
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debugrnglists data. A logic error in the handling of the debugrnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.41-11
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69646?
CVE-2025-69646 is classified as a denial-of-service vulnerability.
How do I fix CVE-2025-69646?
To mitigate CVE-2025-69646, update to the latest version of GNU Binutils that addresses this vulnerability.
What software is affected by CVE-2025-69646?
CVE-2025-69646 affects the GNU Binutils software package.
What is the nature of the issue in CVE-2025-69646?
CVE-2025-69646 involves a logic error in processing malformed DWARF debug_rnglists data.
What happens when CVE-2025-69646 is exploited?
Exploitation of CVE-2025-69646 can lead to an infinite loop, causing objdump to repeatedly issue warning messages without terminating.