CVE-2025-69645: Binutils objdump DOS Vulnerability

CVE-2025-69645 Overview

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

Critical Impact
An attacker can cause a denial of service by supplying a specially crafted binary file with malformed DWARF debug information, causing objdump to abort unexpectedly. This could disrupt development workflows, CI/CD pipelines, or any automated binary analysis processes relying on binutils.

Affected Products

Binutils 2.44

Discovery Timeline

2026-03-06 - CVE CVE-2025-69645 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2025-69645

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), manifesting as a denial-of-service condition in the Binutils objdump utility. The flaw exists in how objdump parses DWARF debugging information embedded within binary files. DWARF is a widely-used debugging data format that stores information about variables, types, and source code mapping within compiled binaries.

When processing DWARF compilation units, a logic error allows an invalid offset_size value to propagate into the byte_get_little_endian function. This function is responsible for reading multi-byte values from the binary in little-endian format. When called with an unexpected or invalid size parameter, the function encounters an unhandled condition that triggers a SIGABRT signal, causing immediate process termination.

Root Cause

The root cause is a logic error in the DWARF parsing code that fails to properly validate the offset_size field within DWARF compilation unit headers. The offset_size value determines whether 32-bit or 64-bit offsets are used within the DWARF data structures. When a malformed binary supplies an invalid value for this field, the validation checks do not catch the anomaly before it reaches byte_get_little_endian, which then receives an unsupported size parameter and calls abort().

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious binary file containing malformed DWARF debug information and convince a user or automated system to analyze it using objdump. Common attack scenarios include:

Submitting malicious binaries to automated build or analysis systems
Including crafted object files in source code repositories
Targeting reverse engineers or security researchers who analyze untrusted binaries
Disrupting CI/CD pipelines that use objdump for binary inspection

When the vulnerable objdump utility processes the malicious file with DWARF-related options (such as -W or --dwarf), it encounters the malformed compilation unit, leading to an unrecoverable abort condition.

Detection Methods for CVE-2025-69645

Indicators of Compromise

Unexpected SIGABRT crashes of objdump processes when analyzing binary files
Core dump files generated by objdump with stack traces pointing to byte_get_little_endian
Binary files with unusually structured or malformed DWARF sections (.debug_info, .debug_abbrev)
Repeated objdump failures in automated build or analysis pipelines

Detection Strategies

Monitor for abnormal termination patterns of binutils processes, particularly SIGABRT signals
Implement file integrity monitoring on binaries processed by automated systems
Use sandboxed environments when analyzing untrusted binary files with objdump
Review system logs for repeated objdump crashes that may indicate exploitation attempts

Monitoring Recommendations

Configure process monitoring to alert on unexpected objdump terminations
Implement rate limiting or isolation for binary analysis operations in CI/CD environments
Consider deploying static analysis tools to pre-screen binaries before processing with vulnerable tools
Monitor for anomalous patterns in binary file submissions to automated systems

How to Mitigate CVE-2025-69645

Immediate Actions Required

Update Binutils to a patched version that includes the fix from commit cdb728d
Avoid using objdump with DWARF parsing options (-W, --dwarf) on untrusted binary files until patched
Isolate binary analysis operations in sandboxed or containerized environments
Implement input validation or pre-screening for binary files before processing

Patch Information

A fix has been committed to the Binutils Git repository. The patch is available in commit cdb728d. System administrators should update to a Binutils release that includes this commit or apply the patch manually to their local builds.

For additional technical details about the vulnerability, refer to Sourceware Bug Report #33637.

Workarounds

Process untrusted binaries in isolated sandbox environments to contain potential crashes
Avoid DWARF parsing flags (-W, --dwarf) when running objdump on untrusted input files
Use alternative tools for DWARF analysis that may not be affected by this specific issue
Implement wrapper scripts that validate binary structure before passing to objdump

bash

# Example: Run objdump in a sandboxed environment using firejail
firejail --quiet --private objdump -W untrusted_binary.o

# Alternative: Use timeout to limit impact of potential hangs
timeout 30s objdump -d untrusted_binary.o