GNU Binutils
CVE-2025-66866
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted file to c++filt
-
ExploitTrigger input-validation fault in d_abi_tags
-
ImpactCrash demangler process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires the GNU C++ demangler in binutils 2.26 (reachable via the c++filt/cxxfilt utility, or any tool linking its demangling routines) to process attacker-controlled input - specifically a crafted file/symbol that drives malformed parsing in d_abi_tags. Limiting factors: exploitation needs the victim or an automated pipeline to actually run the demangler on the attacker-supplied input (local/pipeline input path, not a listening network service, despite the input's AV:N); impact is confined to crashing the demangling process (no code execution, no confidentiality/integrity loss); and it is tied to the old 2.26 release, so environments on patched/newer binutils are not affected. |
| Impact | Signals point consistently to LOW real-world urgency despite the 7.5 'High' CVSS. The published vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/A:H) scores this as a remote, unauthenticated, high-availability-impact flaw, but that framing is questionable: the affected code is d_abi_tags in cp-demangle.c, the GNU C++ symbol demangler reached via the c++filt/cxxfilt utility, and the sole reference is a cxxfilt crash write-up - i.e. a local command-line tool that crashes when fed crafted input, not a network-facing service. The CVSS AV:N therefore appears over-scored; realistic exploitation is local/pipeline input (verify with vendor/NVD before treating as network-remote). EPSS is low (0.31%, 22th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. A POC exists (a crash reproducer), but POC availability is distinct from exploitation and only demonstrates a process crash. Net: a genuine but low-impact robustness bug in a very old binutils release (2.26, 2016), not a priority patch item unless untrusted binaries are auto-processed by a vulnerable demangler in a build/analysis pipeline. |
| Exploit ScenarioDerived | An attacker supplies a maliciously crafted file (or an object/binary containing a malformed mangled C++ symbol) to a build, triage, or malware-analysis pipeline that runs c++filt/cxxfilt or otherwise invokes binutils 2.26's demangler. Parsing the crafted input in d_abi_tags triggers a crash (CWE-20 improper input validation), causing a denial of service of the demangling process. A public crash reproducer exists, but impact is limited to crashing the utility rather than host compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in GNU Binutils 2.26 can be triggered when the C++ demangler processes a crafted PE file, causing a crash in d_abi_tags within cp-demangle.c. The vulnerable component is reachable through c++filt/cxxfilt or any tool that links the demangling routines; the authoritative assessment rates this as a local/pipeline input issue with no authentication and only low availability impact, rather than a remotely reachable network service flaw. Publicly available exploit code exists, but EPSS is only 0.31% (22nd percentile) and there is no KEV confirmation in the provided data.
RemediationAI
No vendor-released patch or exact fixed version is provided in the available references. Because the issue is tied to binutils 2.26 and the independent assessment notes that patched/newer binutils environments are not affected, the primary remediation is to upgrade to a current supported binutils release beyond 2.26. If an upgrade cannot be performed immediately, avoid running c++filt/cxxfilt or any C++ demangler on attacker-controlled PE files or symbol data, and restrict automated pipelines that pass untrusted inputs into demangling routines; this reduces exposure but degrades debugging and symbol-resolution capability. Run demangling jobs with crash isolation and resource limits so a malformed file only terminates that process, and monitor the supplied POC reference for updates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU Binutils includes cp-demangle.c, which implements C++ symbol demangling used by utilities such as c++filt/cxxfilt and by other programs linking those routines. CVE-2025-66866 is an improper input validation issue (CWE-20) in function d_abi_tags, part of parsing ABI tags in mangled C++ names, where a crafted PE file drives malformed parsing that terminates the demangling process. The CPE identifies the affected release as cpe:2.3:a:gnu:binutils:2.26:*:*:*:*:*:*:*. Although the supplied NVD-style vector lists AV:N, the authoritative assessment sets AV:L because the attacker-controlled input must be fed to the demangler locally or through an automated pipeline, not delivered to a listening network service; impact is confined to availability (crash) with no code execution, confidentiality loss, or integrity loss.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crash in a local command-line demangler fed crafted input, so AV:L; only the utility process crashes (no system-wide outage), giving A:L with no C/I impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
DescriptionNVD
An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Executive ViewAI
A denial-of-service flaw in GNU Binutils 2.26 allows a crafted PE file to crash the C++ demangler used by c++filt/cxxfilt and by any internal tool that links the demangling routines, meaning build pipelines, CI/CD jobs, and developer tooling that process untrusted binaries or object files are the exposed surface rather than customer-facing network services. Because the issue is triggered by local or pipeline-supplied input and only degrades availability, the practical risk is disruption to engineering throughput and release velocity, not data loss or external compromise. Publicly available exploit code exists but observed exploitation activity remains very low per EPSS, so this warrants remediation planning rather than emergency escalation.
No vendor-released patch identified at time of analysis. Interim mitigations: run all demangling of untrusted PE/object files inside disposable, resource-limited sandbox containers that cannot reach build secrets, production networks, or credential stores; enforce strict allow-listing and integrity validation of artifacts entering CI/CD so externally sourced PE files are rejected before they reach c++filt, cxxfilt, or any tool linking the demangling routines; restrict local execution of the vulnerable tools to trusted inputs and trusted users; add crash monitoring and pipeline timeouts so a demangler denial-of-service fails fast without stalling builds; and track the GNU Binutils security advisory feed and your distribution vendor for a fixed release, since publicly available exploit code exists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Exploit-DB