Binutils CVE-2025-69649

HIGH

NULL Pointer Dereference (CWE-476)

2026-03-06 cve@mitre.org

Memory Corruption Null Pointer Dereference Red Hat Binutils Suse Gnu

High

Disputed · 7.5 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-476 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Null pointer safety, defensive checks MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available.
Exploit ScenarioDerived	An attacker could exploit this flaw, a segmentation fault (SIGSEGV) and abrupt termination.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 12, 2026

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. [CVSS 7.5 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

Classified as CWE-476 (NULL Pointer Dereference). Affects Binutils. GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.

Know when Binutils gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat 3.3 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

3

PoC Detected

Mar 11, 2026 - 15:51 vuln.today

Public exploit code

Patch released

Mar 11, 2026 - 15:51 nvd

Patch available

CVE Published

Mar 06, 2026 - 19:16 nvd

HIGH 7.5

DescriptionCVE.org

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.

Executive ViewAI

Why It Matters

A high-severity vulnerability in GNU Binutils readelf allows attackers to crash systems or potentially execute code by processing malicious ELF files. Organizations using readelf for binary analysis, malware analysis, or automated build/deployment pipelines are at risk of service disruption or compromise.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

58

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*

Related Vulnerabilities in GNU Binutils readelf Memory Safety

View all 4

CVE-2025-69651 MEDIUM POC

CVE-2025-69650 HIGH POC

CVE-2025-69652 MEDIUM POC

More in Binutils

View all

CVE-2014-8503 HIGH Act Now POC

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac

CVE-2017-7614 CRITICAL Act Now POC

elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a

CVE-2018-12699 CRITICAL Act Now POC

finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o

CVE-2014-8502 HIGH Act Now POC

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo

CVE-2017-6969 CRITICAL Act Now POC

readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate

CVE-2014-8501 HIGH This Week POC

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus

CVE-2014-8504 HIGH This Week POC

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac

CVE-2017-9749 HIGH This Week POC

The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer

CVE-2017-9746 HIGH This Week POC

The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b

CVE-2014-8485 HIGH This Week POC

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni

CVE-2017-9750 HIGH This Week POC

opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t

CVE-2017-9748 HIGH This Week POC

The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

CVE-2014-3470 MEDIUM

CVE-2020-1967 HIGH POC

CVE-2017-3730 HIGH POC

CVE-2017-3169 CRITICAL POC

CVE-2016-4957 HIGH

CVE-2021-3449 MEDIUM

CVE-2015-3194 HIGH

Same technique Memory Corruption

View all

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2014-0322 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2010-3333 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed

References

Advisories & patches

PATCH https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy