CVE-2025-69650 Memory corruption in n/a
A double free vulnerability in GNU Binutils readelf causes a denial of service when processing crafted ELF binaries with malformed relocation data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69650?
CVE-2025-69650 is a high-severity memory corruption vulnerability in Gnu Binutils, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
Weakness: CWE-415
Which versions are affected by CVE-2025-69650?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2025-69650?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-69650 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69650 exists.
Other vulnerabilities in Gnu Binutils
Sources
Also known as AZL-79562, AZL-79586, DEBIAN-CVE-2025-69650, ECHO-68b8-eff0-6628, GHSA-6m68-w836-p72w, MINI-2683-8qxh-v6v5 and 3 more.