GNU Binutils CVE-2025-8225

Exploitation requires local system access and low-privilege user authentication (CVSS PR:L). The attacker must be able to invoke Binutils tools (readelf, objdump, nm, etc.) and supply a crafted ELF binary with malicious DWARF debug sections as input. Default installations of Binutils do not prevent local users from using these tools, making exploitation feasible in shared systems or development environments. The vulnerability is NOT triggered by default configuration; rather, it requires the specific act of parsing a maliciously crafted DWARF section. Network-facing services are unlikely to be affected unless they explicitly parse untrusted binaries through Binutils. The impact is limited to availability via memory exhaustion and does not enable privilege escalation, code execution, or information disclosure.

The CVSS 4.0 score of 1.9 with vector AV:L/AC:L/PR:L reflects a local attack requiring authentication and low complexity, with availability impact only (VA:L) and no confidentiality or integrity impact. The EPSS score of 0.03% (10th percentile) indicates very low real-world exploitation probability despite POC availability, suggesting this is a low-priority vulnerability. The limiting factors are clear: local access required, authenticated user needed (PR:L means low privileges), and impact limited to memory exhaustion rather than code execution or privilege escalation. The presence of publicly available exploit code combined with extremely low EPSS suggests the issue may require specific conditions (such as processing particularly crafted binaries) or may be difficult to weaponize at scale. The availability-only impact means this is a denial-of-service vector affecting service availability rather than confidentiality or integrity. For most environments, this represents a low-priority issue unless the system runs untrusted binaries through Binutils tools continuously.

A local authenticated user crafts or obtains a specially formatted ELF binary with malicious DWARF debug section metadata. The user then invokes a Binutils tool like readelf or objdump on this binary, which triggers the memory leak in process_debug_info during DWARF parsing. With repeated invocations or a sufficiently large debug section, memory consumption grows until available memory is exhausted, causing the tool to crash or the system to experience denial of service.