CVE-2025-69645
published 2026-03-06CVE-2025-69645: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the…
PriorityP419medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.17%
6.1th percentile
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | binutils | — | — |
| gnu | binutils | — | — |
| msrc | azl3_binutils_2.41-10_on_azure_linux_3.0 | — | — |
| msrc | cbl2_binutils_2.37-20_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r62f-9x32-57f4: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information
ghsa_unreviewed·2026-03-06
CVE-2025-69645 [MEDIUM] CWE-400 GHSA-r62f-9x32-57f4: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
OSV
CVE-2025-69645: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information
osv·2026-03-06·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Microsoft
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result
vendor_msrc·2026-03-10·CVSS 5.5
CVE-2025-69645 [MEDIUM] CWE-400 Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Red Hat
binutils: Binutils objdump: Denial of Service via crafted DWARF debug information
vendor_redhat·2026-03-06·CVSS 5.5
CVE-2025-69645 [MEDIUM] CWE-1285 binutils: Binutils objdump: Denial of Service via crafted DWARF debug information
binutils: Binutils objdump: Denial of Service via crafted DWARF debug information
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
A flaw was found in binutils, specifically in the `objdump` utility. A local attacker can exploit this vulnerability by providing a specially crafted binary file containing malformed DWARF (Debugging With Attributed Record Formats) debug information. This can lead to a logic error during the
Debian
CVE-2025-69645: binutils - Binutils objdump contains a denial-of-service vulnerability when processing a cr...
vendor_debian·2025·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645: binutils - Binutils objdump contains a denial-of-service vulnerability when processing a cr...
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-69645 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69645 :
NixOS vulnerability analysis and mitigation
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Source : NVD
## 5.5
Score
Published March 6, 2026
Severity MEDIUM
CNA Score 5.5
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
A
Bugzilla
CVE-2025-69645 mingw-binutils: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
bugzilla·2026-03-06·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645 mingw-binutils: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
CVE-2025-69645 mingw-binutils: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9174e6ea37 (mingw-binutils-2.45.1-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9174e6ea37
---
FEDORA-2026-9174e6ea37 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9174e6ea37`
You can provide feedback for this upda
Bugzilla
CVE-2025-69645 binutils: Binutils objdump: Denial of Service via crafted DWARF debug information
bugzilla·2026-03-06·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645 binutils: Binutils objdump: Denial of Service via crafted DWARF debug information
CVE-2025-69645 binutils: Binutils objdump: Denial of Service via crafted DWARF debug information
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Bugzilla
CVE-2025-69645 rizin: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
bugzilla·2026-03-06·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645 rizin: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
CVE-2025-69645 rizin: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2025-69645 radare2: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
bugzilla·2026-03-06·CVSS 5.5
CVE-2025-69645 [MEDIUM] CVE-2025-69645 radare2: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
CVE-2025-69645 radare2: Binutils objdump: Denial of Service via crafted DWARF debug information [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
2026-03-06
Published