CVE catalog

CVE-2025-69647

GNU Binutils thru 2.45.1 readelf contains a…

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Jan 1, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.16% · Oct 27, 2026

Projects and upstream resources

[binutils][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	binutils	`2.46-1`	FixedDistribution-reported fixed boundary	[CVE-2025-69647]
Debiansid	binutils	`2.47.50.20261021-1`	Fixed	[CVE-2025-69647]
Debianforky	binutils	`2.46-1`	FixedDistribution-reported fixed boundary	[CVE-2025-69647]
Debianforky	binutils	`2.47.50.20261021-1`	Fixed	[CVE-2025-69647]

Showing 4 fix observations. All 37 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	binutils	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2025-69647]
Debianbookworm	binutils	`2.40-2`	Affected	[CVE-2025-69647]
Debianforky	binutils	`2.46-1`	FixedDistribution-reported fixed boundary	[CVE-2025-69647]
Debianforky	binutils	`2.47.50.20261021-1`	Fixed	[CVE-2025-69647]
Debiansid	binutils	`2.46-1`	FixedDistribution-reported fixed boundary	[CVE-2025-69647]
Debiansid	binutils	`2.47.50.20261021-1`	Fixed	[CVE-2025-69647]
Debiantrixie	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2025-69647]
Debiantrixie	binutils	`2.44-3`	Affected	[CVE-2025-69647]
Ubuntu24.04	binutils	`2.41-5ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.41-6ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.41.50.20231206-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.41.50.20231214-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.41.50.20231227-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.41.90.20240122-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-3ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.10`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu24.04	binutils	`2.42-4ubuntu2.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.44-3ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.44.50.20250602-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.44.50.20250604-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.44.50.20250616-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.44.50.20250707-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.45-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.45-3ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.45-6ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.45-7ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.45-7ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC
Ubuntu25.10	binutils	`2.45-7ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2025-69647]Apr 22, 2026, 4:14:09 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "binutils",
      "status": "fixed",
      "release": "sid",
      "version": "2.47.50.20261021-1"
    },
    {
      "name": "binutils",
      "status": "fixed",
      "release": "forky",
      "version": "2.47.50.20261021-1"
    },
    {
      "name": "binutils",
      "status": "vulnerable",
      "release": "trixie",
      "version": "2.44-3"
    },
    {
      "name": "binutils",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.40-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "2.46-1"
    },
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "2.46-1"
    },
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "binutils",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "binutils",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "2.41-5ubuntu1",
        "2.41-6ubuntu1",
        "2.41.50.20231206-1ubuntu1",
        "2.41.50.20231214-1ubuntu1",
        "2.41.50.20231227-1ubuntu1",
        "2.41.90.20240122-1ubuntu1",
        "2.42-2ubuntu1",
        "2.42-3ubuntu1",
        "2.42-4ubuntu1",
        "2.42-4ubuntu2",
        "2.42-4ubuntu2.3",
        "2.42-4ubuntu2.4",
        "2.42-4ubuntu2.5",
        "2.42-4ubuntu2.6",
        "2.42-4ubuntu2.7",
        "2.42-4ubuntu2.8",
        "2.42-4ubuntu2.10"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-69647",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-69647",
      "provider_updated_at": "2026-04-22T16:14:09.890033Z",
      "applicability_unknown": true
    },
    {
      "name": "binutils",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "2.44-3ubuntu1",
        "2.44.50.20250602-0ubuntu1",
        "2.44.50.20250604-0ubuntu2",
        "2.44.50.20250616-0ubuntu1",
        "2.44.50.20250707-1ubuntu1",
        "2.45-1ubuntu1",
        "2.45-3ubuntu3",
        "2.45-6ubuntu1",
        "2.45-7ubuntu1",
        "2.45-7ubuntu1.1",
        "2.45-7ubuntu1.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-69647",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-69647",
      "provider_updated_at": "2026-04-22T16:14:09.890033Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[binutils]Unknown
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-aarch64-linux-gnu]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-aarch64-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-alpha-linux-gnu]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-alpha-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-arc-linux-gnu]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-arc-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-arm-linux-gnueabi]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-arm-linux-gnueabi-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-arm-linux-gnueabihf]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-arm-linux-gnueabihf-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-common]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-dev]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-doc]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · all · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · all · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-for-build]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · all · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · all · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-for-host]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
- 2.40-2 · arm64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-hppa64-linux-gnu]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-hppa64-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-hppa-linux-gnu]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12
[binutils-hppa-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Affected
  nvd · binutils · debian · bookworm; nvd · binutils · debian · 12

Next results

Observed: Oct 24, 2026, 12:37:33 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]