CVE-2025-69647 Denial of service in n/a
A local attacker can cause a denial of service in readelf by providing a crafted binary with malformed DWARF data, leading to an infinite output loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69647?
CVE-2025-69647 is a medium-severity denial of service vulnerability in Gnu Binutils, published on 9 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.
Weakness: CWE-835
Which versions are affected by CVE-2025-69647?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2025-69647?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-69647 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69647 exists.
Other vulnerabilities in Gnu Binutils
Sources
Also known as AZL-79826, BELL-CVE-2025-69647, DEBIAN-CVE-2025-69647, ECHO-0786-47fc-4824, GHSA-pqfr-x96j-g24p, MINI-xv7p-mhp8-6r2j and 1 more.