Description
A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | elfutils | 0.192 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | elfutils | No fix yet | — |
| Debian 13 | elfutils | No fix yet | — |
| Debian 12 | elfutils | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | elfutils | 0.190-1.1ubuntu0.1 | USN-7369-1 |
| Ubuntu 22.04 LTS | elfutils | 0.186-1ubuntu0.1 | USN-7369-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP7 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP6 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP6 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP5 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP5 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP4 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES 15 SP4 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES for SAP 15 SP5 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES for SAP 15 SP4 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLES for SAP 15 SP4 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE Micro 5.5 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE Micro 5.4 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE Micro 5.3 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE HPC 15 SP5 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE HPC 15 SP5 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE HPC 15 SP4 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SLE HPC 15 SP4 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SUSE Manager Server LTS 4.3 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SUSE Manager Server LTS 4.3 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SUSE Manager Proxy LTS 4.3 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| SUSE Manager Proxy LTS 4.3 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | elfutils | 0.185-150400.5.8.3 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
| openSUSE Leap 15.6 | elfutils-debuginfod | 0.185-150400.5.8.2 | SUSE-SU-2025:4092-1, SUSE-RU-2025:4092-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | elfutils | 0.189-4 | — |
Advisories 4
- WID-SEC-2026-0778 Dell Secure Connect Gateway Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- USN-7369-1 elfutils vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2025:4092-1 Security update for elfutils SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-RU-2025:4092-1 Security update for elfutils SUSE / openSUSE Security Updates · Mar 23, 2026
References
- VDB-295985 | GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service vdb-entry technical-description
- VDB-295985 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #497539 | GNU elfutils/eu-strip 0.192 illegal read access third-party-advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=32673 issue-tracking
- https://sourceware.org/bugzilla/attachment.cgi?id=15941 exploit
- https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2 issue-tracking patch
- https://www.gnu.org/ product