CVE-2025-66864: 
NixOS vulnerability analysis and mitigation

CVE-2025-66864 is a NULL pointer dereference vulnerability in the d_print_comp_inner function within cp-demangle.c in GNU BinUtils version 2.26, allowing attackers to cause a denial of service via a crafted PE (Portable Executable) file. The vulnerability was published on December 29, 2025, and affects specifically BinUtils 2.26. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) combined with improper input validation (CWE-20) in the C++ symbol demangling logic within libiberty/cp-demangle.c at line 4442. When the cxxfilt utility processes a specially crafted input (e.g., piped via stdin), the d_print_comp_inner function attempts to read from a zero-page address, triggering a SIGSEGV. The crash call chain proceeds through d_print_comp → cplus_demangle_print_callback → d_demangle_callback → d_demangle → cplus_demangle_v3 → cplus_demangle → demangle_it → main, meaning any tool or pipeline invoking BinUtils demangling on untrusted input is potentially affected (GitHub PoC, Red Hat Bugzilla).

Successful exploitation causes the affected BinUtils process (e.g., cxxfilt, objdump, or other tools invoking the demangling library) to crash with a segmentation fault, resulting in a denial of service. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems or CI/CD pipelines that automatically process untrusted binary files using BinUtils 2.26 are at risk of service interruption (Red Hat Advisory, GitHub PoC).

A public proof-of-concept (PoC) is available in the researcher's GitHub repository, demonstrating the crash using a crafted input file piped to cxxfilt compiled with AddressSanitizer (GitHub PoC). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is very low at approximately 0.018%, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 280133 (Feedly).

1. Prepare environment: Set up a system with GNU BinUtils 2.26 installed, or compile it from source (e.g., using the Docker image silkeh/clang:12 with clang and AddressSanitizer flags).
2. Obtain the PoC file: Download the crafted input file poc5 from the public repository: wget https://github.com/caozhzh/CRGF-Vul/raw/refs/heads/main/pocs/poc5.
3. Trigger the vulnerability: Pipe the crafted file to the cxxfilt binary: cat poc5 | binutils/cxxfilt. This causes the demangling logic in d_print_comp_inner to dereference a NULL pointer.
4. Observe crash: The process terminates with a SIGSEGV (AddressSanitizer reports: SEGV on unknown address 0x000000000000 at cp-demangle.c:4442:30 in d_print_comp_inner), achieving denial of service against the BinUtils process (GitHub PoC).

• Process: Unexpected termination (SIGSEGV/segmentation fault) of cxxfilt, objdump, nm, or other BinUtils processes when processing external or user-supplied binary files.
• Logs: System logs (e.g., /var/log/syslog or dmesg) showing segfault entries for BinUtils binaries: cxxfilt[PID]: segfault at 0 ip ... error 4.
• File System: Presence of unexpected or externally sourced PE/binary files in directories processed by automated BinUtils pipelines.
• AddressSanitizer output (if compiled with ASAN): Error messages referencing SEGV on unknown address 0x000000000000 in d_print_comp_inner at cp-demangle.c:4442 (GitHub PoC).

The primary mitigation is to upgrade GNU BinUtils to a version newer than 2.26, as the vulnerability is specific to that release. Until an upgrade is feasible, avoid processing untrusted or externally sourced PE/binary files with BinUtils tools. Additional mitigations include restricting access to BinUtils utilities, implementing input validation before processing binary files, and using sandboxing (e.g., containers or seccomp profiles) when handling unknown executables (Red Hat Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Security Response team and assigned it a low severity/priority in their Bugzilla system, reflecting its limited exploitability and scope (Red Hat Bugzilla). Coverage has appeared on security aggregation platforms including VulDB, Vulners, and INCIBE-CERT, and Tenable has released a Nessus detection plugin (280133). No significant researcher commentary or social media discussion beyond routine CVE tracking has been observed.