Resource exhaustion in Gnu Binutils
CVE-2025-69646
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.002 (5.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Gnu Binutils — versions 2.44
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Issue Tracking)
- cve@mitre.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-69646?
- CVE-2025-69646 is a medium-severity vulnerability in Gnu Binutils, classified under Uncontrolled Resource Consumption. CVSS score: 5.5/10. Published 2026-03-06.
- How severe is CVE-2025-69646?
- Medium severity. CVSS v3 base score is 5.5 out of 10.