CVE-2025-66861
published 2025-12-29CVE-2025-66861: An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE…
PriorityP47low2.5CVSS 3.1
AVLACHPRNUIRSUCNINAL
EPSS
0.14%
3.9th percentile
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | binutils | — | — |
| gnu | binutils | — | — |
CVSS provenance
nvdv3.12.5LOWCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
osv2.5LOW
vendor_debian2.5LOW
vendor_redhat2.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-66861: An issue was discovered in function d_unqualified_name in file cp-demangle
osv·2025-12-29·CVSS 2.5
CVE-2025-66861 [LOW] CVE-2025-66861: An issue was discovered in function d_unqualified_name in file cp-demangle
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
GHSA
GHSA-r326-pp3g-7cq4: An issue was discovered in function d_unqualified_name in file cp-demangle
ghsa_unreviewed·2025-12-29
CVE-2025-66861 [LOW] CWE-400 GHSA-r326-pp3g-7cq4: An issue was discovered in function d_unqualified_name in file cp-demangle
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
Red Hat
binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c
vendor_redhat·2025-12-29·CVSS 2.5
CVE-2025-66861 [LOW] CWE-125 binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c
binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger an out-of-bounds read in the d_unqualified_name function in the cp-demangle.c file, causing a crash and resulting in a denial of service.
Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a
Debian
CVE-2025-66861: binutils - An issue was discovered in function d_unqualified_name in file cp-demangle.c in ...
vendor_debian·2025·CVSS 2.5
CVE-2025-66861 [LOW] CVE-2025-66861: binutils - An issue was discovered in function d_unqualified_name in file cp-demangle.c in ...
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-66861 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.5
CVE-2025-66861 [LOW] CVE-2025-66861 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-66861 :
NixOS vulnerability analysis and mitigation
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
Source : NVD
## 2.5
Score
Published December 29, 2025
Severity LOW
CNA Score 2.5
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
binutils-gold
gcc-toolset-14-binutils-gprofng
Sources
NVD
Chainguard No Fix Added at: Jan 15, 2026
Debian 11, 12, 13, 14 Severity LOW No Fix Added at: Dec 30, 2025
Echo Severity LOW Has Fix Added at: Dec 30, 2025
Homebre
Bugzilla
CVE-2025-66861 binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c
bugzilla·2025-12-29·CVSS 2.5
CVE-2025-66861 [LOW] CVE-2025-66861 binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c
CVE-2025-66861 binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c
An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
2025-12-29
Published