Resource exhaustion in GNU Binutils
CVE-2025-69646
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.002 (3.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 3.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- GNU Binutils — versions 2.44
Weakness classification (CWE)
References
- sourceware.org/bugzilla/show_bug.cgi (Exploit, Issue Tracking)
- sourceware.org/git/gitweb.cgi (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-69646?
- CVE-2025-69646 is a medium-severity vulnerability in GNU Binutils, classified under Uncontrolled Resource Consumption. CVSS score: 5.5/10. Published 2026-03-06.
- How severe is CVE-2025-69646?
- Medium severity. CVSS v3 base score is 5.5 out of 10.