CVE-2025-69645: Binutils objdump DOS Vulnerability

CVE-2025-69645 Overview

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

Critical Impact

An attacker can cause a denial of service by supplying a specially crafted binary file with malformed DWARF debug information, causing objdump to abort unexpectedly. This could disrupt development workflows, CI/CD pipelines, or any automated binary analysis processes relying on binutils.

Affected Products

• Binutils 2.44

Discovery Timeline

• 2026-03-06 - CVE CVE-2025-69645 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2025-69645

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), manifesting as a denial-of-service condition in the Binutils objdump utility. The flaw exists in how objdump parses DWARF debugging information embedded within binary files. DWARF is a widely-used debugging data format that stores information about variables, types, and source code mapping within compiled binaries.

When processing DWARF compilation units, a logic error allows an invalid offset_size value to propagate into the byte_get_little_endian function. This function is responsible for reading multi-byte values from the binary in little-endian format. When called with an unexpected or invalid size parameter, the function encounters an unhandled condition that triggers a SIGABRT signal, causing immediate process termination.

Root Cause

The root cause is a logic error in the DWARF parsing code that fails to properly validate the offset_size field within DWARF compilation unit headers. The offset_size value determines whether 32-bit or 64-bit offsets are used within the DWARF data structures. When a malformed binary supplies an invalid value for this field, the validation checks do not catch the anomaly before it reaches byte_get_little_endian, which then receives an unsupported size parameter and calls abort().

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious binary file containing malformed DWARF debug information and convince a user or automated system to analyze it using objdump. Common attack scenarios include:

• Submitting malicious binaries to automated build or analysis systems
• Including crafted object files in source code repositories
• Targeting reverse engineers or security researchers who analyze untrusted binaries
• Disrupting CI/CD pipelines that use objdump for binary inspection

When the vulnerable objdump utility processes the malicious file with DWARF-related options (such as -W or --dwarf), it encounters the malformed compilation unit, leading to an unrecoverable abort condition.

Detection Methods for CVE-2025-69645

Indicators of Compromise

• Unexpected SIGABRT crashes of objdump processes when analyzing binary files
• Core dump files generated by objdump with stack traces pointing to byte_get_little_endian
• Binary files with unusually structured or malformed DWARF sections (.debug_info, .debug_abbrev)
• Repeated objdump failures in automated build or analysis pipelines

Detection Strategies

• Monitor for abnormal termination patterns of binutils processes, particularly SIGABRT signals
• Implement file integrity monitoring on binaries processed by automated systems
• Use sandboxed environments when analyzing untrusted binary files with objdump
• Review system logs for repeated objdump crashes that may indicate exploitation attempts

Monitoring Recommendations

• Configure process monitoring to alert on unexpected objdump terminations
• Implement rate limiting or isolation for binary analysis operations in CI/CD environments
• Consider deploying static analysis tools to pre-screen binaries before processing with vulnerable tools
• Monitor for anomalous patterns in binary file submissions to automated systems

How to Mitigate CVE-2025-69645

Immediate Actions Required

• Update Binutils to a patched version that includes the fix from commit cdb728d
• Avoid using objdump with DWARF parsing options (-W, --dwarf) on untrusted binary files until patched
• Isolate binary analysis operations in sandboxed or containerized environments
• Implement input validation or pre-screening for binary files before processing

Patch Information

A fix has been committed to the Binutils Git repository. The patch is available in commit cdb728d. System administrators should update to a Binutils release that includes this commit or apply the patch manually to their local builds.

For additional technical details about the vulnerability, refer to Sourceware Bug Report #33637.

Workarounds

• Process untrusted binaries in isolated sandbox environments to contain potential crashes
• Avoid DWARF parsing flags (-W, --dwarf) when running objdump on untrusted input files
• Use alternative tools for DWARF analysis that may not be affected by this specific issue
• Implement wrapper scripts that validate binary structure before passing to objdump

# Example: Run objdump in a sandboxed environment using firejail
firejail --quiet --private objdump -W untrusted_binary.o

# Alternative: Use timeout to limit impact of potential hangs
timeout 30s objdump -d untrusted_binary.o