CVE-2025-66862: 
NixOS vulnerability analysis and mitigation

CVE-2025-66862 is a heap-based buffer overflow vulnerability in the gnu_special function within cplus-dem.c in GNU BinUtils version 2.26. It allows attackers to cause a denial of service by supplying a crafted PE (Portable Executable) file to affected BinUtils tools such as cxxfilt. The vulnerability was published on December 29, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, GitHub PoC).

The root cause is a heap-based buffer overflow (CWE-122) in the gnu_special function at line 2954 of libiberty/cplus-dem.c in BinUtils 2.26. When cxxfilt (or any tool invoking cplus_demangle) processes a specially crafted input, it allocates a 2-byte heap region during demangle_template_value_parm and subsequently reads 1 byte past the end of that allocation in gnu_special, triggering an AddressSanitizer-detected heap-buffer-overflow. The call chain is: main → demangle_it → cplus_demangle → internal_cplus_demangle → demangle_signature → demangle_template → demangle_template_value_parm → cplus_demangle → internal_cplus_demangle → gnu_special. No authentication or user interaction is required; the attacker only needs to supply a malicious input file or string to a vulnerable BinUtils tool (GitHub PoC).

Successful exploitation causes a denial of service by crashing the affected BinUtils process (e.g., cxxfilt). The impact is limited to availability — confidentiality and integrity are not affected per the CVSS assessment. Systems most at risk include automated build pipelines, binary analysis platforms, reverse engineering toolchains, and security scanning infrastructure that process untrusted PE files using BinUtils 2.26 (Feedly, GitHub PoC).

A public proof-of-concept exploit is available on GitHub, demonstrating the crash via a crafted input file (poc3) piped to cxxfilt compiled with AddressSanitizer. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 280132 has been released to detect this vulnerability (GitHub PoC, Tenable).

1. Prepare the environment: Identify systems running GNU BinUtils 2.26, particularly those that process untrusted PE files or accept piped input (e.g., build servers, binary analysis tools using cxxfilt).
2. Obtain or craft the PoC payload: Download the public PoC file (poc3) from the researcher's GitHub repository (https://github.com/caozhzh/CRGF-Vul/raw/refs/heads/main/pocs/poc3), which contains a specially crafted mangled C++ symbol string designed to trigger the overflow.
3. Deliver the payload: Pipe the crafted input to the cxxfilt binary: cat poc3 | binutils/cxxfilt. This can also be achieved by supplying the crafted PE file to any BinUtils tool that internally invokes cplus_demangle.
4. Trigger the overflow: The malformed input causes demangle_template_value_parm to allocate a 2-byte heap buffer, which gnu_special then reads past, triggering a heap-buffer-overflow at cplus-dem.c:2954.
5. Achieve denial of service: The process aborts (SIGABRT via AddressSanitizer, or a crash in non-instrumented builds), causing the BinUtils tool to become unavailable and potentially disrupting dependent automated pipelines (GitHub PoC).

• Process: Unexpected crashes or aborts of cxxfilt, objdump, nm, or other BinUtils tools; processes terminating with SIGABRT or segmentation faults.
• Logs: AddressSanitizer output containing heap-buffer-overflow in gnu_special at cplus-dem.c:2954; system logs showing repeated abnormal termination of BinUtils processes.
• File System: Presence of the PoC file (poc3) or similarly crafted PE/binary files in directories accessible to BinUtils tools; unexpected files in /tmp or build directories.
• Network: Unusual inbound transfers of small binary files to build servers or analysis systems, particularly from unknown sources, intended to be processed by BinUtils tools (GitHub PoC).

No official patch from GNU BinUtils has been announced for version 2.26 as of the time of this report; users should monitor the GNU BinUtils mailing list and upgrade to a newer release (versions significantly newer than 2.26 are available and recommended). As an interim measure, restrict processing of untrusted PE files through BinUtils tools, implement input validation or sandboxing around BinUtils invocations, and limit network or user access to systems running BinUtils 2.26. Consider using containerization or process isolation to contain the impact of crashes (Feedly, Tenable).

The vulnerability received limited but notable coverage shortly after disclosure. Security news accounts on Bluesky (@thehackerwire.bsky.social) and Mastodon (@thehackerwire) highlighted the issue. The INCIBE-CERT (Spain's national cybersecurity incident response center) published an early alert, and Hong Kong's GovCERT also issued an advisory. Community reaction has been measured, reflecting the moderate severity and limited exploitation potential (Feedly).