Vulnerability · Published Mar 6, 2026 · Assigned by mitre
CVE-2025-69644
Medium 5.0
In plain English
A medium-severity uncontrolled resource consumption in the binutils package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | binutils | no fix listed | DEBIAN-CVE-2025-69644 |
| Debian:13 | binutils | no fix listed | DEBIAN-CVE-2025-69644 |
| Debian:14 | binutils | 2.46-1 | DEBIAN-CVE-2025-69644 |
| Ubuntu:24.04:LTS | binutils | no fix listed | UBUNTU-CVE-2025-69644 |
| Ubuntu:25.10 | binutils | no fix listed | UBUNTU-CVE-2025-69644 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H