GNU Binutils CVE-2025-66862

Exploitation requires that a victim process an attacker-supplied PE/object file through a binutils tool that invokes the gnu_special C++ demangler in cplus-dem.c (typically c++filt, nm, or objdump against a crafted input). The specific affected build is GNU binutils 2.26. Limiting factors: the attacker must get the malicious file onto a system and have it demangled, so exploitation depends on victim action (running the tool on the file) rather than any listening network service; the impact is confined to a denial of service (process crash) with no code execution, data disclosure, or integrity loss; and the affected 2.26 release dates to 2016, so modern systems with updated binutils are unlikely to be affected.

The input assigns CVSS 7.5 driven entirely by availability impact (A:H) with a network vector (AV:N/AC:L/PR:N/UI:N). This network framing is questionable and should be flagged: the flaw is in the gnu_special C++ name-demangler in cplus-dem.c, reached by processing a crafted PE/object file through binutils tools such as c++filt, nm, or objdump - this is overwhelmingly a local file-processing operation requiring the victim to run a binutils tool against an attacker-supplied file, which implies AV:L and UI:R rather than AV:N/UI:N. The sole impact is a crash (denial of service); there is no confidentiality or integrity impact (C:N/I:N), so even in the worst case this terminates a utility process, not a service or host. Signal cross-reference: a public POC exists (crash reproducer in the referenced CRGF-Vul repository), but the CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The combination of POC-only status, DoS-only impact, a short-lived local utility as the target, and an obsolete 2016 version (binutils 2.26) makes this a low real-world priority despite the HIGH nominal CVSS - it is a classic high-CVSS-but-low-operational-risk fuzzing crash. MISSING DATA: no EPSS, no vendor/GNU advisory confirming affected version range, and the CVSS network vector conflicts with the local nature of the demangler - verify with the binutils maintainers.

An attacker crafts a malformed PE/object file containing a mangled C++ symbol that triggers the heap buffer overflow in gnu_special, then induces a developer, analyst, or automated build/CI pipeline to run a binutils demangling tool (e.g. c++filt, nm, or objdump) against it. The tool crashes, denying the demangling/analysis operation. A public crash proof-of-concept exists, but the impact is limited to terminating the utility process rather than code execution or service compromise.