CVE-2025-69650: Double Free
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dumprelocations may return early without initializing the allrelocations array. As a result, processgotsectioncontents() may pass an uninitialized rsymbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69650?
CVE-2025-69650 is classified as a high severity vulnerability due to the potential for exploitation through a double free condition.
How do I fix CVE-2025-69650?
To fix CVE-2025-69650, it is recommended to update to GNU Binutils version 2.47 or later where the vulnerability has been addressed.
What types of software are affected by CVE-2025-69650?
CVE-2025-69650 affects GNU Binutils versions up to and including 2.46, particularly when processing crafted ELF binaries.
What are the risks associated with CVE-2025-69650?
Exploitation of CVE-2025-69650 could lead to application crashes or potentially allow an attacker to execute arbitrary code.
What is the context of CVE-2025-69650 in relation to ELF binaries?
CVE-2025-69650 specifically pertains to vulnerabilities during the handling of malformed relocation data in ELF binaries by the GNU Binutils readelf utility.