GNU Binutils CVE-2025-8224

The attacker must have local user-level access (PR:L) to the affected system. Exploitation requires the ability to create or control a malformed ELF file and invoke a Binutils utility (objdump, readelf, etc.) against it-this is the specific trigger. The vulnerability does NOT require special system configuration, elevated privileges, or network access. The crafted ELF file must contain specific malformations in its section headers or string table metadata that cause the bfd_elf_get_str_section function to encounter null pointer dereference. No user interaction (e.g., social engineering) is needed if the attacker has direct shell access. Exploitation is limited to local threat actors and does not affect systems where untrusted users cannot execute Binutils directly or supply arbitrary file inputs.

This vulnerability presents minimal real-world risk despite moderate CVSS score characteristics. The CVSS 4.0 vector (AV:L/AC:L/PR:L) reflects local attackers with user-level privileges; the impact scope is intentional denial of service only (VA:L, all confidentiality/integrity impacts zero). EPSS score of 0.04% (12th percentile) strongly signals low exploitation probability in the wild, likely due to: (1) requirement for local access and authenticated user context, (2) limited impact (DoS only, no code execution), and (3) narrow trigger condition (malformed ELF files supplied to Binutils). The existence of public exploit code is notable but does not correlate with actual widespread attacks-PoC availability without KEV listing or EPSS signals indicates disclosed but not actively exploited vulnerability. The patch exists (commit db856d41004301b3a56438efd957ef5cabb91530), lowering urgency. This is a low-priority patch candidate suitable for standard maintenance windows rather than emergency response, except in environments where untrusted local users regularly process binary files with Binutils utilities (e.g., embedded security analysis, malware analysis labs).

A local unprivileged user on a shared system creates a malformed ELF file (e.g., with corrupted string section headers or invalid section offsets) and supplies it to a Binutils utility such as readelf or objdump. When the BFD Library's bfd_elf_get_str_section function attempts to parse the string section, it dereferences a null pointer due to insufficient validation, causing the utility to crash and triggering denial of service for other users or processes relying on that tool.