Log in Start free

Vulnerability · Published Jul 27, 2025 · Assigned by VulDB

CVE-2025-8224GNU Binutils BFD Library elf.c bfd_elf_get_str_section null pointer dereference

Low 3.3

In plain English

A low-severity null pointer dereference in Binutils from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 80.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22binutils2.44-r0ALPINE-CVE-2025-8224
Debian:12binutilsno fix listedDEBIAN-CVE-2025-8224
Debian:13binutils2.43.1-4DEBIAN-CVE-2025-8224
Debian:14binutils2.43.1-4DEBIAN-CVE-2025-8224
Ubuntu:22.04:LTSbinutilsno fix listedUBUNTU-CVE-2025-8224
Ubuntu:24.04:LTSbinutilsno fix listedUBUNTU-CVE-2025-8224

Affected products (as reported)

VendorProductVersions
GNU Binutils 2.44

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References