CVE-2023-25586 Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized
An uninitialized variable in Binutils can cause a crash, leading to local denial of service for users processing malicious binaries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-25586?
CVE-2023-25586 is a medium-severity vulnerability in Gnu Binutils, published on 14 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.
Which versions are affected by CVE-2023-25586?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2023-25586?
Apply the vendor's patch.
Is CVE-2023-25586 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25586 exists.
Other vulnerabilities in Gnu Binutils
Sources
Also known as BELL-CVE-2023-25586, DEBIAN-CVE-2023-25586, GHSA-gpjh-j7vh-fwmj.