PT-2026-23734 · Gnu · Gnu Binutils

Published 2026-03-06 · Updated 2026-03-11 · CVE-2025-69651

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils versions through 2.46

Description GNU Binutils versions through 2.46 contain an issue where processing a specially crafted ELF binary with incorrect relocation or symbol data can lead to an invalid pointer being freed. This occurs if the dump relocations function exits prematurely due to parsing errors, leaving the all relocations array partially uninitialized. Subsequently, the process got section contents() function may attempt to free an invalid r symbol pointer, triggering memory corruption checks within glibc and resulting in program termination via a SIGABRT signal. The impact is limited to a denial-of-service condition, with no evidence of further memory corruption or code execution.

Recommendations Versions prior to 2.46 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-79574

AZL-79580

CVE-2025-69651

ECHO-30C0-A594-F90E

RHSA-2026:7098

Affected Products

Gnu Binutils

References · 17

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33700 · Exploit
• https://osv.dev/vulnerability/AZL-79580 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79574 · Vendor Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69651 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69651 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69651 · Security Note
• https://ubuntu.com/security/CVE-2025-69651 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69651 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69651 · Security Note
• https://sourceware.org/bugzilla/show_bug.cgi?id=33698 · Note
• https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=ea4bc025abdba85a90e26e13f551c16a44bfa92 · Note
• https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739 · Note
• https://t.me/msrcreports/3342 · Telegram Post