GNU Binutils CVE-2025-66864

Exploitation requires that a victim run a binutils 2.26 tool that invokes the C++ demangler (c++filt, nm, objdump, addr2line) on attacker-controlled input - a crafted file containing a malformed C++ mangled symbol. The limiting factors are significant: there is no network-facing service, so the attacker must get the malicious input into a local processing step (e.g., CI, build, or binary-analysis pipeline); the impact is confined to crashing the single tool invocation rather than causing a persistent or system-wide outage; and it is tied to the specific legacy version binutils 2.26.

The input CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) scores this as a network-reachable, unauthenticated availability failure, but the signals do not cohere with the actual vulnerability. The flaw is in d_print_comp_inner within cp-demangle.c - the C++ symbol demangler shared by binutils/libiberty tools (c++filt, nm, objdump) - and the single supporting reference is a crash report filed under a 'cxxfilt' project, indicating the real trigger is a crafted mangled symbol processed locally by a command-line tool, not a network service. CONFLICT TO VERIFY: CVSS asserts AV:N but the demangler is a local batch utility with no network listener - the network vector is almost certainly an overstatement, and realistic exploitation is local (AV:L). A publicly available proof-of-concept exists (publicly available exploit code exists), which raises reproducibility, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The impact is a process crash of a developer/build utility, not a persistent service outage, so the A:H rating also appears inflated (closer to A:L). Net judgment: this is a low-to-moderate real-world priority - a reproducible denial-of-service in a local parsing tool against an old binutils version (2.26, released 2016), not a high-urgency remotely exploitable issue despite the 7.5 score.

An attacker supplies a crafted object/PE file or a malicious C++ mangled symbol to a victim who runs a binutils 2.26 tool (such as c++filt, nm, or objdump) that invokes the demangler - for example in an automated build, CI, or malware-analysis pipeline that processes untrusted binaries. Parsing the malformed input drives d_print_comp_inner into an invalid state and crashes the tool, denying the analysis/build step. A public proof-of-concept crash file is available, so the condition is trivially reproducible.