CVE-2025-1365 GNU elfutils eu-readelf readelf.c process_symtab buffer overflow

Medium 4.8 Published 16 Feb 2025 Updated 18 Feb 2025

A buffer overflow in GNU elfutils eu-readelf allows local attackers to execute arbitrary code or cause denial of service via crafted ELF files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-1365?

CVE-2025-1365 is a medium-severity memory corruption vulnerability in GNU elfutils, published on 16 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.

Weakness: CWE-120, CWE-119

Which versions are affected by CVE-2025-1365?

It affects 1 product.

Linux distribution packages (9)

`golang-github-prometheus-node_exporter` SUSE:Linux Enterprise Server 12 SP5-LTSS	All versions	`1.9.1-1.39.2`
`golang-github-prometheus-node_exporter` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`1.9.1-1.39.2`
`golang-github-QubitProducts-exporter_exporter` SUSE:Manager Client Tools 12	All versions	`0.4.0-1.15.2`
`golang-github-boynux-squid_exporter` SUSE:Manager Client Tools 12	All versions	`1.13.0-1.12.2`
`golang-github-lusitaniae-apache_exporter` SUSE:Manager Client Tools 12	All versions	`1.0.10-1.27.3`
`golang-github-prometheus-node_exporter` SUSE:Manager Client Tools 12	All versions	`1.9.1-1.39.2`
`golang-github-prometheus-promu` SUSE:Manager Client Tools 12	All versions	`0.17.0-1.30.2`
`spacecmd` SUSE:Manager Client Tools 12	All versions	`5.0.15-38.165.2`
`uyuni-tools` SUSE:Manager Client Tools 12	All versions	`0.1.38-1.30.2`

Products include Elfutils Project Elfutils.

How do I fix CVE-2025-1365?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-1365 being exploited?

There is no known exploitation of CVE-2025-1365 in the wild and no public exploit code.

Sources

Also known as AZL-56968, BELL-CVE-2025-1365, DEBIAN-CVE-2025-1365, ECHO-2179-0037-6b90, GHSA-h2c8-cfp8-j597, ROOT-OS-DEBIAN-12-CVE-2025-1365 and 2 more.