CVE-2025-66863: 
NixOS vulnerability analysis and mitigation

CVE-2025-66863 is a denial-of-service vulnerability in the d_discriminator function within cp-demangle.c in GNU BinUtils version 2.26. An attacker can trigger a segmentation fault (SEGV) by supplying a crafted PE file to the cxxfilt demangling utility, causing uncontrolled resource consumption and application crash. The vulnerability was published on December 29, 2025, and affects specifically BinUtils 2.26. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, GitHub PoC).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), manifesting as a null or invalid pointer dereference (READ access to a high-value address) in the d_discriminator function at cp-demangle.c:3471. The crash is triggered when a specially crafted input is piped to the cxxfilt binary, which invokes the C++ symbol demangling code path: main → demangle_it → cplus_demangle → cplus_demangle_v3 → d_demangle → d_demangle_callback → cplus_demangle_mangled_name → d_encoding → d_name → d_unqualified_name → d_discriminator. The vulnerability requires no authentication or user interaction and is exploitable over the network (attack vector: Network, complexity: Low) when the affected binary processes untrusted input (GitHub PoC, Feedly).

Successful exploitation causes the cxxfilt process (and any application relying on BinUtils 2.26 demangling functionality) to crash with a fatal SEGV signal, resulting in a denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems or pipelines that automatically process untrusted binary files using BinUtils 2.26 are at risk of repeated crashes if exposed to malicious input (Feedly, GitHub PoC).

A public proof-of-concept exploit is available on GitHub, demonstrating the crash using a crafted poc2 file piped to the cxxfilt binary compiled with AddressSanitizer (GitHub PoC). The EPSS score is very low at 0.000180, indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain the PoC payload: Download the crafted poc2 file from the public GitHub repository: wget https://github.com/caozhzh/CRGF-Vul/raw/refs/heads/main/pocs/poc2.
2. Set up a vulnerable environment: Deploy BinUtils 2.26 (e.g., using the Docker image silkeh/clang:12), compile with clang and AddressSanitizer flags (-g -Wno-error -fsanitize=address), and build the cxxfilt binary.
3. Trigger the vulnerability: Pipe the crafted file to the cxxfilt binary: cat poc2 | binutils/cxxfilt. This causes the demangling code path to reach d_discriminator in cp-demangle.c:3471 with an invalid memory address.
4. Observe the crash: The process terminates with AddressSanitizer: SEGV on unknown address due to a READ access fault in d_discriminator, resulting in denial of service (GitHub PoC).

• Process: Unexpected termination or crash of cxxfilt or other BinUtils processes with a segmentation fault signal (SIGSEGV).
• Logs: AddressSanitizer output containing SEGV on unknown address referencing d_discriminator in cp-demangle.c:3471; system logs showing abnormal exits of BinUtils binaries.
• File System: Presence of unexpected or unknown binary/PE files submitted to BinUtils processing pipelines; core dump files generated by cxxfilt crashes.
• Network: Unusual or automated submission of PE files to services that invoke BinUtils demangling functionality (GitHub PoC, Feedly).

No official patch from GNU BinUtils has been announced for this vulnerability as of the time of reporting. Organizations should upgrade BinUtils from version 2.26 to a more recent release (e.g., 2.42 or later), which may not be affected. As interim mitigations: restrict network access to systems running BinUtils 2.26, avoid processing untrusted or externally supplied PE files with the affected version, and monitor for unexpected crashes in BinUtils-related processes. A Nessus detection plugin (ID 280129) is available for identifying vulnerable systems (Feedly, Tenable).

The vulnerability received limited but broad automated coverage across vulnerability tracking platforms including VulDB, CVEFeed, and ENISA's EUVD shortly after publication. Social media mentions appeared on Bluesky and Mastodon via automated CVE tracking accounts. No significant vendor statements or notable security researcher commentary beyond the original PoC submission have been identified (Feedly).