Vulnerability · Published Mar 6, 2026 · Assigned by mitre
CVE-2025-69646
Medium 5.5
In plain English
A medium-severity uncontrolled resource consumption in the binutils package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | binutils | no fix listed | DEBIAN-CVE-2025-69646 |
| Debian:13 | binutils | no fix listed | DEBIAN-CVE-2025-69646 |
| Debian:14 | binutils | 2.46-1 | DEBIAN-CVE-2025-69646 |
| Ubuntu:24.04:LTS | binutils | no fix listed | UBUNTU-CVE-2025-69646 |
| Ubuntu:25.10 | binutils | no fix listed | UBUNTU-CVE-2025-69646 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H