CVE-2025-66862
published 2025-12-29CVE-2025-66862: A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
PriorityP434high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.32%
24.0th percentile
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | binutils | — | — |
| gnu | binutils | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c
vendor_redhat·2025-12-29·CVSS 7.5
CVE-2025-66862 [HIGH] CWE-125 binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c
binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a heap-based buffer over-read in the gnu_special function in the cplus-dem.c file, causing a crash and resulting in a denial of service.
Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this heap-based buffer over-read is only triggered during the parsing of a specially crafted file, requiring an attacker to convin
Debian
CVE-2025-66862: binutils - A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in B...
vendor_debian·2025·CVSS 7.5
CVE-2025-66862 [HIGH] CVE-2025-66862: binutils - A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in B...
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
GHSA-rhg5-g54m-7cq3: A buffer overflow vulnerability in function gnu_special in file cplus-dem
ghsa_unreviewed·2025-12-29
CVE-2025-66862 [HIGH] CWE-122 GHSA-rhg5-g54m-7cq3: A buffer overflow vulnerability in function gnu_special in file cplus-dem
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
OSV
CVE-2025-66862: A buffer overflow vulnerability in function gnu_special in file cplus-dem
osv·2025-12-29·CVSS 7.5
CVE-2025-66862 [HIGH] CVE-2025-66862: A buffer overflow vulnerability in function gnu_special in file cplus-dem
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-66862 binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c
bugzilla·2025-12-29·CVSS 7.5
CVE-2025-66862 [HIGH] CVE-2025-66862 binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c
CVE-2025-66862 binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Wiz
CVE-2025-66862 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-66862 [HIGH] CVE-2025-66862 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-66862 :
NixOS vulnerability analysis and mitigation
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Source : NVD
## 7.5
Score
Published December 29, 2025
Severity HIGH
CNA Score 7.5
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 22.8
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
gcc-toolset-15-binutils-devel
gdb-gdbserver
Sources
NVD
Chainguard No Fix Added at: Jan 15, 2026
Debian 11, 12, 13, 14 Severity LOW No Fix Added at: Dec 30, 2025
Echo Severity HIGH Has Fix Added at: Dec 30, 2025
Homebrew
2025-12-29
Published