Log in Start free

Vulnerability · Published Jan 29, 2025 · Assigned by VulDB

CVE-2025-0840GNU Binutils objdump.c disassemble_bytes stack-based overflow

Medium 5.0

In plain English

A medium-severity stack buffer overflow in Binutils from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20binutils2.42-r1ALPINE-CVE-2025-0840
Alpine:v3.21binutils2.43.1-r2ALPINE-CVE-2025-0840
Alpine:v3.22binutils2.44-r0ALPINE-CVE-2025-0840
Alpine:v3.23binutils2.44-r0ALPINE-CVE-2025-0840
Alpine:v3.24binutils2.44-r0ALPINE-CVE-2025-0840
Debian:12binutilsno fix listedDEBIAN-CVE-2025-0840
Debian:13binutils2.43.90.20250122-1DEBIAN-CVE-2025-0840
Debian:14binutils2.43.90.20250122-1DEBIAN-CVE-2025-0840
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.7USN-7306-1
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.11USN-7899-1
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.7UBUNTU-CVE-2025-0840
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.7USN-7899-1
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.4USN-7306-1
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.4UBUNTU-CVE-2025-0840
Ubuntu:25.10binutils2.45-7ubuntu1.1USN-7899-1

Affected products (as reported)

VendorProductVersions
GNU Binutils 2.02.12.22.32.42.52.62.7

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References