CVE catalog
CVE-2025-8224
binutils: CVE-2025-8224
- Severity
- Low · CVSS 3.3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.26% · Oct 25, 2026
A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | binutils | sid | 2.47.50.20261021-1 | fixed |
| Debian | binutils | forky | 2.47.50.20261021-1 | fixed |
| Debian | binutils | trixie | 2.44-3 | fixed |
| Debian | binutils | bookworm | 2.40-2 | vulnerable |
| Cpe | binutils | Not reported | Not reported | unknown |
| Alpine | binutils | 3.22 | 2.44-r0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | binutils | source | sid | 2.43.1-4 | unimportant | Not reported | Not reported |
| Debian | binutils | source | forky | 2.43.1-4 | unimportant | Not reported | Not reported |
| Debian | binutils | source | trixie | 2.43.1-4 | unimportant | Not reported | Not reported |
| Debian | binutils | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
| Alpine | binutils | apk | 3.22 | 2.44-r0 | Not reported | ALPINE-CVE-2025-8224 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json]
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_21195-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2025-8224]
- [https://osv.dev/vulnerability/ALPINE-CVE-2025-8224]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-8224]
- [https://security-tracker.debian.org/tracker/CVE-2025-8224]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8224.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1647.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]