GNU Binutils CVE-2025-66863
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file with malformed C++ symbol
-
ExploitVictim runs binutils demangling tool (c++filt/nm/objdump)
-
ExecutionTrigger resource exhaustion in d_discriminator
-
ImpactCrash utility process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user or automated process to invoke a GNU binutils C++ demangling code path (c++filt, nm -C, objdump -C/--demangle, or any libiberty consumer calling the demangler) on an attacker-controlled file or symbol string from binutils 2.26. Limiting factors: it is not a listening network service, so it needs that tool invocation (effective user interaction / local file handling); it affects an old 2.26 release; and impact is limited to crashing the invoked utility - no privilege gain, code execution, or system-wide outage. Defenders running untrusted binaries through automated binutils pipelines are the primary realistic exposure. |
| Impact | Signals conflict sharply and point to a LOW real-world priority despite the 7.5 'High' CVSS. The NVD vector (AV:N/AC:L/PR:N/UI:N/A:H) models this as a remote, unauthenticated, no-interaction availability kill - but the underlying defect is a resource-exhaustion crash (CWE-400) in the C++ symbol demangler (d_discriminator in cp-demangle.c, part of libiberty) reached through command-line binutils tools, and the single public reference is a crash report against cxxfilt (c++filt). Realistically a victim or pipeline must RUN a binutils utility on an attacker-supplied file, so AV:N and UI:N are overstated - this behaves like a local/file-processing issue (verify: description says 'crafted PE file' fed to a tool, which implies local processing, not a network-reachable service). A public POC exists (a documented crash), but POC availability is NOT active exploitation; there is NO CISA KEV listing and NO EPSS score was provided, so widespread or targeted exploitation cannot be asserted. Impact is confined to crashing a developer/build utility process - no confidentiality or integrity loss, no code execution. Net: a genuine but low-severity DoS in an old binutils version, not a priority outside hardened automated analysis pipelines that process untrusted binaries. |
| Exploit ScenarioDerived | An attacker crafts a file containing a malformed mangled C++ symbol that drives the d_discriminator demangling routine into uncontrolled resource consumption. When a developer, CI job, or malware-analysis pipeline runs a binutils tool such as c++filt, nm -C, or objdump -C against the file, the demangler exhausts resources and the utility crashes. A public crash report (POC) for the cxxfilt path exists, but it demonstrates a crash only, not code execution or remote service compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in GNU binutils 2.26 through its C++ demangling code path (cp-demangle.c, function d_discriminator), where a crafted input fed to tools such as c++filt, nm -C or objdump -C can crash the invoking utility; publicly available exploit code exists (a published cxxfilt crash proof-of-concept), and no CISA KEV entry or vendor advisory appears in the supplied intelligence. The independent assessment rates this LOW real-world priority: the assessed vector is local with user interaction (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), which directly contradicts the NVD-style 7.5 'High' network-vector score, because binutils is not a listening network service - an attacker must get a victim or automated pipeline to demangle an attacker-controlled symbol string or file, and the worst outcome is a crashed tool rather than code execution, privilege gain or system-wide outage. Defenders running untrusted binaries or symbol strings through automated binutils demangling pipelines are the primary realistic exposure.
RemediationAI
No vendor-released patch was identified at time of analysis; the only reference supplied is a public proof-of-concept (https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash2.md), with no upstream commit, vendor advisory or fixed version number to cite, so replacement version numbers should not be assumed. Because binutils 2.26 is roughly a decade old and unsupported, the practical remediation is to move to a currently maintained binutils release and re-test the PoC, treating the upgrade as a hardening measure rather than a confirmed fix, and to review the churn risk that a major toolchain jump introduces for build reproducibility. Where upgrading is not immediately possible, compensating controls are: avoid demangling untrusted input (drop -C/--demangle from nm and objdump and avoid piping untrusted symbol strings into c++filt) - the trade-off is significantly less readable diagnostics; and where demangling must occur, run the affected tools in a sandboxed, resource-capped context (address-space and stack limits via ulimit -v/-s, a wall-clock timeout, and a cgroup/container memory cap) so that the uncontrolled-resource crash is contained to a disposable process - the trade-off is that legitimate large binaries may hit the same limits and must be tuned. Restrict the exposure surface further by ensuring automated pipelines only demangle artefacts from trusted or verified build inputs, since the crash requires an attacker-controlled file or symbol string to reach the demangler in the first place.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cp-demangle.c is the libiberty C++ ABI demangler used across the GNU toolchain: c++filt, nm -C, objdump -C/--demangle, and any libiberty consumer (including debuggers and compiler diagnostic printers) that needs to turn mangled names such as _ZN... back into readable form. The affected function, d_discriminator, is part of the recursive-descent grammar for discriminating substitution, template and operator-name constructs; malformed or maliciously nested mangled input drives the parser into unbounded recursion or allocation, which is exactly the CWE-400 (Uncontrolled Resource Consumption) resource-exhaustion class assigned to this CVE and matches the observed crash behaviour in the published PoC. The supplied CPE (cpe:2.3:a:gnu:binutils:2.26:*:*:*:*:*:*:*) pins the confirmed affected release to binutils 2.26, an old release line no longer receiving upstream maintenance attention. Note the framing mismatch in the source data: the description attributes the trigger to a crafted PE file, while the PoC reference exercises the standalone cxxfilt binary, meaning either a malformed PE/COFF object carrying an attacker-controlled mangled symbol name or a raw mangled string supplied on the command line can reach the vulnerable parser; the correctness of that reachability beyond the PoC path is not independently confirmed.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A victim must run a binutils demangling tool on the attacker file (AV:L, UI:R), and the only effect is crashing that single utility process (A:L; C:N/I:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Executive ViewAI
GNU binutils 2.26 has a denial-of-service vulnerability in its C++ demangling path that can crash utilities such as c++filt, nm -C, and objdump -C when they process a crafted symbol string, and publicly available exploit code exists (no CISA KEV entry). The practical risk is concentrated in teams or automated pipelines that deliberately demangle untrusted binaries or symbol strings, where the worst credible outcome is a crashed tool rather than code execution, privilege gain, or a system-wide outage. Leadership should treat this as a low-priority availability concern unless a business-critical pipeline depends on demangling untrusted input at scale.
No vendor-released patch identified at time of analysis; interim mitigations include blocking or restricting demangling of untrusted symbol strings/files, running c++filt, nm -C, and objdump -C in isolated sandboxes with resource and timeout limits, disabling automated demangling pipelines for untrusted inputs, applying least privilege, and monitoring for tool crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Exploit-DB