GNU Binutils CVE-2025-66861

Exploitation requires an attacker to supply a crafted input (a malicious symbol name, per the description delivered via a PE file) that is then processed by a GNU Binutils 2.26 demangler using the d_unqualified_name function in cp-demangle.c - in practice the c++filt/cxxfilt utility or any tool linking libiberty's C++ demangler. Limiting factors are significant: the vector is local (AV:L), a user must actively run the vulnerable demangling tool on the attacker-controlled input (UI:R), the NVD rates attack complexity as high (AC:H), and the only consequence is a crash of that single utility (A:L) with no confidentiality or integrity impact and no scope change - so this cannot be triggered remotely or unattended and does not compromise the host.

This is a genuinely low-priority issue and the multiple signals agree rather than conflict. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, base 2.5) describes a purely local vulnerability requiring user interaction, with no confidentiality or integrity impact and only limited availability impact - consistent with a tool crash rather than code execution. EPSS reinforces this: 0.15% probability at the 3rd percentile indicates essentially no observed real-world exploitation interest. The CVE is NOT on CISA KEV, so there is no evidence of active exploitation. Public exploit/crash reproducer code does exist (a crash write-up in the CRGF-Vul repository targeting cxxfilt), but POC availability is a separate signal from active exploitation and does not elevate this to priority status given the local vector and trivial impact (crashing a command-line demangling utility). No SSVC decision data was supplied in the input. One data note: the description says the crash is triggered via a crafted PE file, while the only reference is a cxxfilt (c++filt / symbol demangler) crash - these are consistent if a symbol string from a PE file is demangled, but the exact input path should be verified against the upstream binutils bug report, which was not provided. Net assessment: low real-world risk; a CVSS 2.5 denial-of-service that aligns with its low EPSS and non-KEV status.

An attacker crafts a malicious file (or a symbol name within one) and convinces a developer, analyst, or build/CI process to run a binutils demangling utility such as c++filt/cxxfilt on it; the d_unqualified_name routine in cp-demangle.c mishandles the input and the tool crashes, denying that operation. A public crash reproducer exists, but exploitation requires local access and the victim actively running the vulnerable tool on the attacker-supplied input (AV:L, UI:R), and the impact is limited to crashing the utility - no code execution or data exposure.