CVE-2025-69644 Denial of service in n/a
A local attacker can cause a denial of service in Binutils objdump by providing a crafted binary with malformed debug information, leading to an unbounded loop.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-69644?
CVE-2025-69644 is a medium-severity denial of service vulnerability in Gnu Binutils, published on 6 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.
Weakness: CWE-400
Which versions are affected by CVE-2025-69644?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2025-69644?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-69644 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69644 exists.
Other vulnerabilities in Gnu Binutils
Sources
Also known as AZL-79577, AZL-79598, BELL-CVE-2025-69644, DEBIAN-CVE-2025-69644, ECHO-b155-ed65-13d4, GHSA-6j8w-mcjj-7669 and 2 more.