CVE catalog
CVE-2025-1372
elfutils vulnerabilities
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.35% · Oct 25, 2026
A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | elfutils | sid | 0.196-1 | vulnerable |
| Debian | elfutils | forky | 0.196-1 | vulnerable |
| Debian | elfutils | trixie | 0.192-4 | vulnerable |
| Debian | elfutils | bookworm | 0.188-2.1 | vulnerable |
| Ubuntu | elfutils | noble | Not reported | vulnerable |
| Ubuntu | elfutils | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | debuginfod | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libasm-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libasm1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdebuginfod-common | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdebuginfod-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdebuginfod1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdw-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libdw1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libelf-dev | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | libelf1t64 | noble | 0.190-1.1ubuntu0.1 | fixed |
| Ubuntu | elfutils | 22.04 | 0.185-1build1 | vulnerable |
| Ubuntu | elfutils | 22.04 | 0.185-2 | vulnerable |
| Ubuntu | elfutils | 22.04 | 0.186-1 | vulnerable |
| Ubuntu | elfutils | 22.04 | 0.186-1build1 | vulnerable |
| Ubuntu | elfutils | 22.04 | 0.186-1ubuntu0.1 | fixed |
| Ubuntu | elfutils | 24.04 | 0.189-4 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build2 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build3 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build4 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1build4.1 | vulnerable |
| Ubuntu | elfutils | 24.04 | 0.190-1.1ubuntu0.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | elfutils | source | sid | (unfixed) | unimportant | Not reported | Not reported |
| Debian | elfutils | source | forky | (unfixed) | unimportant | Not reported | Not reported |
| Debian | elfutils | source | trixie | (unfixed) | unimportant | Not reported | Not reported |
| Debian | elfutils | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
| Ubuntu | elfutils | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | debuginfod | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libasm-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libasm1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdebuginfod-common | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdebuginfod-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdebuginfod1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdw-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libdw1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libelf-dev | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | libelf1t64 | deb | noble | 0.190-1.1ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | elfutils | deb | 22.04 | 0.186-1ubuntu0.1 | Not reported | UBUNTU-CVE-2025-1372 | Not reported |
| Ubuntu | elfutils | deb | 24.04 | 0.190-1.1ubuntu0.1 | Not reported | UBUNTU-CVE-2025-1372 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [debuginfod]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [elfutils]Affected
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libasm1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libasm-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdebuginfod1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdebuginfod-common]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· all · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· all · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· all · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· all · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdebuginfod-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdw1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libdw-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libelf1]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
- [libelf-dev]Affected
Source package: [elfutils]
Details (4)
0.188-2.1· amd64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.188-2.1· arm64 · bookwormAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· amd64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
0.192-4~bpo12+1· arm64 · bookworm-backportsAffected
usn · elfutils · debian · bookworm; usn · elfutils · debian · 12
[Debian 13 (Trixie)]
- [debuginfod]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [elfutils]Affected
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libasm1t64]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libasm-dev]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdebuginfod1t64]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdebuginfod-common]Affected
Source package: [elfutils]
Details (4)
0.192-4· all · trixieAffected
usn · elfutils · debian · 13
0.192-4· all · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· all · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· all · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdebuginfod-dev]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdw1t64]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
- [libdw-dev]Affected
Source package: [elfutils]
Details (4)
0.192-4· amd64 · trixieAffected
usn · elfutils · debian · 13
0.192-4· arm64 · trixieAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· amd64 · trixie-backportsAffected
usn · elfutils · debian · 13
0.195-1~bpo13+1· arm64 · trixie-backportsAffected
usn · elfutils · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-ru-2025_4092-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-1372]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-1372]
- [https://security-tracker.debian.org/tracker/CVE-2025-1372]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-1372.json]
- [https://ubuntu.com/security/notices/USN-7369-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0778.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]