CVE catalog
CVE-2025-1365
elfutils vulnerabilities
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.34% · Oct 25, 2026
A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | elfutils | sid | 0.196-1 | vulnerable |
| Debian | elfutils | forky | 0.196-1 | vulnerable |
| Debian | elfutils | trixie | 0.192-4 | vulnerable |
| Debian | elfutils | bookworm | 0.188-2.1 | vulnerable |
| Ubuntu | elfutils | noble | Not reported | vulnerable |
| Ubuntu | elfutils | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | debuginfod | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libasm-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libasm1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdebuginfod-common | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdebuginfod-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdebuginfod1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdw-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdw1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libelf-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libelf1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | elfutils | 24.04 | 0.189-4 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build2 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build3 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build4 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build4.1 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1ubuntu0.1 | fixed |
| Suse | golang-github-QubitProducts-exporter_exporter | manager client tools 12 | 0.4.0-1.15.2 | fixed |
| Suse | golang-github-boynux-squid_exporter | manager client tools 12 | 1.13.0-1.12.2 | fixed |
| Suse | golang-github-lusitaniae-apache_exporter | manager client tools 12 | 1.0.10-1.27.3 | fixed |
| Suse | golang-github-prometheus-node_exporter | manager client tools 12 | 1.9.1-1.39.2 | fixed |
| Suse | golang-github-prometheus-promu | manager client tools 12 | 0.17.0-1.30.2 | fixed |
| Suse | spacecmd | manager client tools 12 | 5.0.15-38.165.2 | fixed |
| Suse | uyuni-tools | manager client tools 12 | 0.1.38-1.30.2 | fixed |
| Suse | golang-github-prometheus-node_exporter | linux enterprise server 12 sp5-ltss | 1.9.1-1.39.2 | fixed |
| Suse | golang-github-prometheus-node_exporter | linux enterprise server ltss extended security 12 sp5 | 1.9.1-1.39.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | elfutils | source | sid | (unfixed) | unimportant | Not reported | Not reported |
| Debian | elfutils | source | forky | (unfixed) | unimportant | Not reported | Not reported |
| Debian | elfutils | source | trixie | (unfixed) | unimportant | Not reported | Not reported |
| Debian | elfutils | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
| Ubuntu | elfutils | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | debuginfod | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libasm-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libasm1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdebuginfod-common | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdebuginfod-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdebuginfod1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdw-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdw1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libelf-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libelf1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | elfutils | deb | 24.04 | 0.190-1.1ubuntu0.1 | Not reported | UBUNTU-CVE-2025-1365 | Not reported |
| Suse | golang-github-QubitProducts-exporter_exporter | rpm | manager client tools 12 | 0.4.0-1.15.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | golang-github-boynux-squid_exporter | rpm | manager client tools 12 | 1.13.0-1.12.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | golang-github-lusitaniae-apache_exporter | rpm | manager client tools 12 | 1.0.10-1.27.3 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | golang-github-prometheus-node_exporter | rpm | manager client tools 12 | 1.9.1-1.39.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | golang-github-prometheus-promu | rpm | manager client tools 12 | 0.17.0-1.30.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | spacecmd | rpm | manager client tools 12 | 5.0.15-38.165.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | uyuni-tools | rpm | manager client tools 12 | 0.1.38-1.30.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | golang-github-prometheus-node_exporter | rpm | linux enterprise server 12 sp5-ltss | 1.9.1-1.39.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
| Suse | golang-github-prometheus-node_exporter | rpm | linux enterprise server ltss extended security 12 sp5 | 1.9.1-1.39.2 | Not reported | SUSE-SU-2026:1011-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [debuginfod]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [elfutils]Affected
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libasm1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libasm-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdebuginfod1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdebuginfod-common]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· all · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· all · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· all · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· all · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdebuginfod-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdw1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdw-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libelf1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libelf-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
[Debian 13 (Trixie)]
- [debuginfod]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [elfutils]Affected
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libasm1t64]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libasm-dev]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdebuginfod1t64]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdebuginfod-common]Affected
Source package: [elfutils]
Details (4)
0.192-4· all · trixieAffected
usn · elfutils · debian · 13
0.192-4· all · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· all · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· all · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdebuginfod-dev]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdw1t64]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdw-dev]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-1365]
- [https://osv.dev/vulnerability/SUSE-SU-2026:1011-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-1365]
- [https://security-tracker.debian.org/tracker/CVE-2025-1365]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-1365.json]
- [https://ubuntu.com/security/notices/USN-7369-1]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]