PT-2026-23740 · Gnu · Gnu Binutils

Published 2025-12-07 · Updated 2026-03-12 · CVE-2025-69650

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU Binutils versions through 2.46

Description The software contains a double free issue when processing specially crafted ELF binaries with incorrect relocation data. Specifically, during Global Offset Table (GOT) relocation processing, the dump relocations function may prematurely return without properly initializing the all relocations array. Subsequently, the process got section contents function might pass an uninitialized pointer, r symbol, to the free() function, resulting in a double free and program termination via a SIGABRT signal. The impact is limited to a denial-of-service condition, with no observed evidence of exploitable memory corruption or code execution.

Recommendations Update to a version of GNU Binutils newer than 2.46.

Exploit

Fix

DoS

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

AZL-79562

AZL-79586

BDU:2026-04342

CVE-2025-69650

ECHO-68B8-EFF0-6628

RHSA-2026:7098

Affected Products

Gnu Binutils

References · 18

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33698 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-69650 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-69650 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79562 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69650 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69650 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69650 · Security Note
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921 · Patch
• https://osv.dev/vulnerability/CVE-2025-69650 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04342 · Security Note
• https://osv.dev/vulnerability/AZL-79586 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69650 · Vendor Advisory
• https://t.me/cveNotify/155319 · Telegram Post
• https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739 · Note
• https://sourceware.org/bugzilla/show_bug.cgi?id=33700 · Note