CVE-2025-66861: 
NixOS vulnerability analysis and mitigation

CVE-2025-66861 is a denial-of-service vulnerability in GNU BinUtils 2.26, specifically in the d_unqualified_name function within libiberty/cp-demangle.c. An attacker can trigger a segmentation fault (SEGV) by supplying a crafted PE file to tools such as cxxfilt that invoke the C++ demangler. The vulnerability was published on December 29, 2025, and affects only BinUtils version 2.26. It carries a CVSS v3.1 base score of 2.5 (Low) (Feedly, GitHub PoC).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), manifesting as a null/invalid pointer dereference (SEGV on unknown address) during a READ memory access at cp-demangle.c:1596 in the d_unqualified_name function. Exploitation requires piping or feeding a specially crafted input to a BinUtils tool (e.g., cxxfilt) that triggers the demangling code path through cplus_demangle_mangled_name → d_encoding → d_bare_function_type → d_pointer_to_member_type → cplus_demangle_type → d_expression → d_unqualified_name. The attack vector is local (AV:L), requires user interaction (UI:R), and has high attack complexity (AC:H), meaning an attacker must convince a user or automated pipeline to process a malicious file. A public proof-of-concept crash reproducer is available (GitHub PoC).

Successful exploitation causes the affected BinUtils tool (e.g., cxxfilt) to crash with a fatal SEGV signal, resulting in a denial-of-service condition. There is no impact on confidentiality or integrity — only availability is affected, and only at a low severity level given the local, interactive nature of the attack. Automated build pipelines or binary analysis environments that process untrusted PE files using BinUtils 2.26 are the most plausible targets (Feedly, GitHub PoC).

A proof-of-concept exploit (a crafted binary poc1) is publicly available on GitHub and was added to the NVD exploit reference list on January 14, 2026. There is no evidence of in-the-wild exploitation, and the EPSS score is extremely low at 0.000180 (approximately 0.018%), reflecting minimal real-world exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub PoC).

1. Prepare the environment: Obtain a system with BinUtils 2.26 installed (e.g., compile from source using clang with AddressSanitizer: export CC=clang; export CFLAGS="-g -Wno-error -fsanitize=address"; ./configure && make -j).
2. Obtain the PoC file: Download the crafted input file: wget https://github.com/caozhzh/CRGF-Vul/raw/refs/heads/main/pocs/poc1.
3. Trigger the crash: Pipe the crafted file into the cxxfilt binary: cat poc1 | binutils/cxxfilt.
4. Observe the crash: The demangler processes the malformed input, traverses a deeply nested type-parsing call chain, and dereferences an invalid pointer at d_unqualified_name (cp-demangle.c:1596), causing a SEGV and process termination (GitHub PoC).

• Process: Unexpected crash or abnormal termination of cxxfilt, objdump, nm, or other BinUtils tools that invoke the C++ demangler when processing PE files.
• Logs: AddressSanitizer output containing SEGV on unknown address with stack trace referencing d_unqualified_name in cp-demangle.c:1596; process exit with signal 11 (SIGSEGV).
• File System: Presence of unexpected or externally sourced PE/binary files in directories processed by automated BinUtils-based pipelines.
• Network: Downloads of files named poc1 or similar from github.com/caozhzh/CRGF-Vul in environments where such access is unexpected (GitHub PoC).

No official patch has been released for BinUtils 2.26 specifically addressing this CVE. Organizations should upgrade to a newer version of GNU BinUtils (post-2.26), as the codebase has received numerous fixes since that release. As an interim measure, restrict processing of untrusted or user-supplied PE files through BinUtils tools, and avoid exposing cxxfilt or similar utilities to unvalidated input in automated pipelines. Monitor the GNU BinUtils project and downstream Linux distribution advisories for patch availability (Feedly).

Coverage has been limited to automated vulnerability aggregators (VulDB, Vulners, CVEFeed, ENISA EUVD) and a Bluesky CVE notification post. Tenable added a Nessus detection plugin (ID 280126) for this vulnerability. No notable researcher commentary or vendor statements beyond routine aggregation have been identified (Feedly, Tenable Nessus).