CVE-2025-66865: 
NixOS vulnerability analysis and mitigation

CVE-2025-66865 is a stack-based buffer overflow (stack exhaustion via unbounded recursion) vulnerability in the d_print_comp_inner function within cp-demangle.c in GNU BinUtils version 2.26. The flaw allows attackers to cause a denial of service by supplying a specially crafted PE (Portable Executable) file to any application using the vulnerable libiberty demangling code. It was publicly disclosed on December 29, 2025, and affects specifically GNU BinUtils 2.26. The CVSS v3.1 base score is 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow), manifesting as unbounded mutual recursion between d_print_comp_inner (cp-demangle.c:4320/4976/4988) and d_print_comp (cp-demangle.c:5394) when processing deeply nested or maliciously structured C++ mangled symbol names embedded in a crafted PE file. The recursive call chain exhausts the process stack, triggering an AddressSanitizer: stack-overflow fatal signal. No authentication or user interaction is required; an attacker only needs to supply a malicious PE file to a service or tool that invokes BinUtils' demangling functionality (e.g., cxxfilt). A public proof-of-concept reproducing the crash via cat poc4 | binutils/cxxfilt is available (PoC GitHub).

Successful exploitation results in a crash of the affected BinUtils tool or any application linking against the vulnerable libiberty library, causing a denial of service. There is no confidentiality or integrity impact — the vulnerability is limited strictly to availability. Systems or CI/CD pipelines that automatically process untrusted PE files (e.g., build servers, binary analysis tools, debuggers) are at elevated risk of service disruption (Red Hat CVE, PoC GitHub).

A public proof-of-concept exploit is available on GitHub demonstrating reliable crash reproduction against BinUtils 2.26 (PoC GitHub). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nessus detection plugin (ID 280127) is available (Tenable).

1. Prepare the crafted PE file: Obtain or craft a PE file containing deeply nested C++ mangled symbol names designed to trigger unbounded recursion in the demangler. The public PoC file (poc4) from the researcher's GitHub repository can be used directly.
2. Identify a target: Locate a system running GNU BinUtils 2.26 or an application that uses libiberty's demangling functionality (e.g., cxxfilt, objdump, nm, or custom build tooling).
3. Deliver the malicious file: Supply the crafted PE file as input to the vulnerable tool. For cxxfilt, this is as simple as: cat poc4 | binutils/cxxfilt
4. Trigger the crash: The d_print_comp_inner and d_print_comp functions enter mutual recursion, exhausting the process stack and causing a fatal SIGSEGV / stack-overflow, crashing the tool or service (PoC GitHub).

• Process: Unexpected crash or termination of cxxfilt, objdump, nm, or other BinUtils tools; processes exiting with SIGSEGV or SIGABRT signals.
• Logs: AddressSanitizer output containing stack-overflow on address with stack frames referencing d_print_comp_inner in cp-demangle.c:4320 and d_print_comp in cp-demangle.c:5394; repeated crash reports from binary analysis or build pipeline services.
• File System: Presence of unexpected or externally sourced PE files in directories processed by BinUtils tools; core dump files generated by cxxfilt or related utilities.
• Network: Unusual inbound delivery of PE files to build servers or binary analysis services, particularly from untrusted or external sources (PoC GitHub).

Organizations should upgrade GNU BinUtils beyond version 2.26 to a patched release; patches are tracked via Red Hat's security advisory system (Red Hat Bugzilla, Red Hat CVE). As an interim measure, restrict processing of untrusted or externally sourced PE files by BinUtils tools, and consider sandboxing binary analysis workflows to limit the blast radius of a crash. Inventory all systems and pipelines using BinUtils 2.26 and prioritize upgrading them. Monitor for unexpected crashes in BinUtils-related processes as a detection signal.

The vulnerability received brief coverage on social media platforms including Mastodon (TheHackerWire) and Bluesky shortly after disclosure in late December 2025. Community sentiment reflects low urgency given the denial-of-service-only impact and the age of the affected version (BinUtils 2.26). No significant vendor statements beyond Red Hat's bug tracking entry have been identified.