CVE-2025-69651: Null Pointer Dereference
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dumprelocations returns early due to parsing errors, the internal allrelocations array may remain partially uninitialized. Later, processgotsectioncontents() may attempt to free an invalid rsymbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69651?
CVE-2025-69651 is categorized as a moderate severity vulnerability due to its potential to lead to denial of service.
How do I fix CVE-2025-69651?
To fix CVE-2025-69651, upgrade GNU Binutils to version 2.47 or later, where the vulnerability has been resolved.
What type of issues does CVE-2025-69651 cause?
CVE-2025-69651 can cause invalid pointer dereferencing, leading to crashes or unexpected behavior when processing malformed ELF binaries.
Which versions of GNU Binutils are affected by CVE-2025-69651?
CVE-2025-69651 affects GNU Binutils versions up to and including 2.46.
Is there a workaround for CVE-2025-69651?
There are no known workarounds for CVE-2025-69651, so upgrading to a patched version is the recommended solution.