Skip to content
OpenAdvisories
Medium · 5.0 CVE-2025-69644 EUVD-2025-208342GHSA-6j8w-mcjj-7669

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary wi…

Published Mar 6, 2026 · Updated Mar 10, 2026 · Assigned by mitre

Description

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 binutils 2.46-1 —
Debian 13 binutils No fix yet —
Debian 12 binutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 binutils No fix yet —
Ubuntu 24.04 LTS binutils No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 binutils +3 2.45.1-5.hum1 RHSA-2026:7098
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed binutils 2.47-1.1 openSUSE-SU-2026:11932-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 binutils No fix yet —
Azure Linux 2 (CBL-Mariner) binutils No fix yet —

Advisories 3

References