CVE-2025-66865: GNU Binutils DOS Vulnerability

CVE-2025-66865 Overview

A stack-based buffer overflow vulnerability has been discovered in GNU BinUtils 2.26, specifically within the d_print_comp_inner function in the cp-demangle.c file. This vulnerability allows remote attackers to cause a denial of service condition by crafting malicious PE (Portable Executable) files that trigger the overflow when processed by affected BinUtils utilities.

Critical Impact

Processing a specially crafted PE file can cause application crashes and denial of service, potentially disrupting development workflows and automated build systems that rely on BinUtils tools like c++filt or nm.

Affected Products

• GNU BinUtils version 2.26
• Systems and applications using the cp-demangle.c demangling functionality
• Development environments and build pipelines utilizing affected BinUtils versions

Discovery Timeline

• 2025-12-29 - CVE-2025-66865 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-66865

Vulnerability Analysis

This vulnerability is classified under CWE-121 (Stack-based Buffer Overflow), indicating that the d_print_comp_inner function in cp-demangle.c fails to properly validate input boundaries when processing demangled symbol names from PE files. The demangling process, which converts compiler-generated symbol names back to human-readable format, can be exploited when handling maliciously constructed input data.

The network attack vector indicates that this vulnerability can be triggered remotely through scenarios where BinUtils processes untrusted PE files, such as in automated analysis pipelines, CI/CD environments, or development tools that handle external binary artifacts.

Root Cause

The root cause lies in insufficient bounds checking within the d_print_comp_inner function when handling symbol demangling operations. The function processes nested component structures recursively, and specially crafted input can cause excessive stack consumption or direct memory corruption through unchecked buffer writes. The lack of proper input validation allows malformed PE file data to overflow stack-allocated buffers during the demangling process.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious PE file containing specially constructed mangled C++ symbol names. When a victim processes this file using BinUtils utilities such as c++filt, nm, objdump, or similar tools that invoke the demangling functionality, the vulnerable d_print_comp_inner function processes the malformed data, leading to a stack buffer overflow and subsequent application crash.

The attack requires no authentication and no user interaction beyond processing the malicious file. Attack scenarios include:

• Submitting malicious binaries to automated analysis systems
• Including crafted objects in open-source repositories
• Exploiting development environments that process external dependencies

The vulnerability mechanism involves recursive processing of demangled symbol components. When the demangling engine encounters deeply nested or malformed component structures in the PE file, the d_print_comp_inner function can exhaust stack space or write beyond allocated buffer boundaries. For technical details and proof of concept information, see the GitHub PoC Repository.

Detection Methods for CVE-2025-66865

Indicators of Compromise

• Unexpected crashes or segmentation faults in BinUtils utilities (c++filt, nm, objdump, readelf)
• Core dumps indicating stack corruption in processes handling PE files
• Abnormal termination of build processes or CI/CD pipelines processing external binaries
• Log entries showing repeated failures when processing specific binary files

Detection Strategies

• Monitor for abnormal process terminations in BinUtils utilities through system logging
• Implement file integrity checking for binaries processed by development tools
• Deploy application-level monitoring to detect stack overflow conditions
• Use sandbox environments for processing untrusted PE files

Monitoring Recommendations

• Enable core dump analysis for BinUtils processes to identify exploitation attempts
• Implement resource limits and process isolation for binary analysis operations
• Configure alerting on repeated crashes of demangling-related processes
• Review logs for patterns indicating malicious file processing attempts

How to Mitigate CVE-2025-66865

Immediate Actions Required

• Upgrade GNU BinUtils to a patched version that addresses this vulnerability
• Avoid processing untrusted PE files with vulnerable BinUtils versions
• Implement process isolation for binary analysis operations
• Deploy input validation to reject malformed PE files before processing

Patch Information

Users should upgrade to a version of GNU BinUtils newer than 2.26 that contains the security fix for the d_print_comp_inner function. Check the official GNU BinUtils project for security advisories and patched releases. Organizations should prioritize updating BinUtils installations in build servers, CI/CD pipelines, and development environments.

Workarounds

• Process untrusted PE files in isolated sandbox environments with resource limits
• Implement stack size limits using ulimit -s to constrain potential overflow damage
• Use containerized environments for binary analysis to contain potential crashes
• Temporarily disable C++ name demangling features when processing untrusted files using the -C flag alternatives

# Configuration example
# Limit stack size to detect overflow attempts early
ulimit -s 8192

# Run c++filt in a restricted environment
firejail --noprofile --timeout=30 c++filt < input.txt

# Process binaries in a container with limited resources
docker run --rm --memory=512m --cpus=0.5 -v $(pwd):/work binutils:safe nm /work/suspicious.exe