Elfutils CVE-2025-1365

MEDIUM

Buffer Overflow (CWE-119)

2025-02-17 cna@vuldb.com

Buffer Overflow Red Hat Suse Elfutils Elfutils Project

4.8

CVSS 4.0 · NVD

Share

Severity by source

NVD PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

4.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

X

Lifecycle Timeline

4

Patch released

Apr 05, 2026 - 02:30 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:27 vuln.today

PoC Detected

Nov 04, 2025 - 20:07 vuln.today

Public exploit code

CVE Published

Feb 17, 2025 - 00:15 nvd

MEDIUM 4.8

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.

AnalysisAI

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue. Affected products include: Elfutils Project Elfutils.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.

More in Elfutils

View all

CVE-2018-16402 CRITICAL Act Now POC

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application cra

CVE-2018-8769 HIGH This Week POC

elfutils 0.170 has a buffer over-read in the ebl_dynamic_tag_name function of libebl/ebldynamictagname.c because SYMTAB_

CVE-2019-7149 MEDIUM This Month POC

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0

CVE-2019-7148 MEDIUM This Month POC

An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfu

CVE-2018-18520 MEDIUM This Month POC

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Rated medium

CVE-2017-7613 MEDIUM This Month POC

elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote att

CVE-2017-7607 MEDIUM This Month POC

The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-b

CVE-2017-7612 MEDIUM This Month POC

The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-b

CVE-2017-7610 MEDIUM This Month POC

The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based

CVE-2017-7608 MEDIUM This Month POC

The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a deni

CVE-2017-7611 MEDIUM This Month POC

The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (hea

CVE-2017-7609 MEDIUM This Month POC

elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2020-0796 CRITICAL POC

CVE-2017-11882 HIGH POC

CVE-2014-6332 HIGH POC

CVE-2015-2426 HIGH POC

CVE-2013-3918 HIGH POC

CVE-2023-4966 HIGH POC

CVE-2017-11774 HIGH POC

CVE-2013-3660 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
SUSE Manager Client Tools 12	Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Fixed
SLES15-SP6-CHOST-BYOS	Fixed

Share

CVE-2025-1365 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy