PT-2026-24065 · Gnu+1 · Gnu Binutils+1

Published 2026-03-09 · Updated 2026-05-06 · CVE-2025-69647

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils versions through 2.45.1

Description GNU Binutils’ readelf utility is susceptible to a denial-of-service condition when processing a specially crafted binary file containing improperly formatted DWARF loclists data. A flaw in the DWARF parsing code can lead to an infinite loop, repeatedly printing the same table output without progressing. This results in excessive CPU and I/O usage, effectively halting the completion of readelf’s analysis unless manually stopped. A local attacker can exploit this by providing a malicious input file.

Recommendations Versions prior to 2.45.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-07157

CVE-2025-69647

ECHO-0786-47FC-4824

RHSA-2026:7098

Affected Products

Gnu Binutils

Red Os

References · 22

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33640 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69647 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69647 · Vendor Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7 · Patch
• https://cve.org/CVERecord?id=CVE-2025-69647 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69647 · Security Note
• https://ubuntu.com/security/CVE-2025-69647 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-69647 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69647 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07157 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69647 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-binutils-cve-2025-69647-8.0 · Note
• https://sourceware.org/git/gitweb.cgi?p=GNU%20Binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-binutils-cve-2025-69647-7.3 · Note
• https://t.me/msrcreports/3425 · Telegram Post