GNU Binutils CVE-2025-66865

Exploitation requires the GNU Binutils C++ demangler (libiberty cp-demangle.c) to process an attacker-controlled mangled symbol - in practice a victim or automated pipeline must invoke a demangling tool such as c++filt (or nm/objdump with demangling) against the crafted input, per the referenced crash PoC. Limiting factors: attacker must get the malicious symbol/file to a system that actually runs the demangler, and the impact is confined to crashing that single tool/process (no code execution, no confidentiality or integrity loss); it affects binutils 2.26 specifically, so patched/newer toolchains are not implicated by this record.

Signals conflict and the real-world priority is modest. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 purely from a High availability impact, but the vulnerability is in the C++ symbol demangler (d_print_comp_inner in cp-demangle.c, part of libiberty) and the only reference is a c++filt crash PoC - this is a local file/symbol-parsing bug, not a network-facing service, so AV:N and UI:N appear overstated (verify: the published PoC triggers via cxxfilt processing attacker-supplied input, implying local/UI-dependent access rather than true remote). The impact is also a single-process crash of a command-line tool, not loss of a system service, so A:H is arguably generous (A:L is more defensible). EPSS is low at 0.38% (30th percentile) and the CVE is NOT in CISA KEV, consistent with no evidence of real-world exploitation; publicly available exploit code exists but PoC availability is not active exploitation. Net: a genuine but low-severity DoS in a build-time/analysis utility - treat as a maintenance-priority patch, not an incident, as the headline 7.5 overstates operational risk for most deployments.

An attacker crafts a malformed mangled C++ symbol (or a binary/PE object containing one) and induces a victim or automated pipeline to run c++filt or another binutils tool that invokes the demangler against it, causing a stack buffer overflow in d_print_comp_inner that crashes the process. Publicly available exploit/crash PoC exists (CRGF-Vul crash4). The practical path is local or supply-chain (e.g., a CI job demangling symbols from an untrusted artifact) rather than remote-unauthenticated despite the AV:N label.