CVE-2025-66866: 
NixOS vulnerability analysis and mitigation

CVE-2025-66866 is a denial-of-service vulnerability in GNU BinUtils 2.26, specifically in the d_abi_tags function within libiberty/cp-demangle.c. An attacker can trigger a segmentation fault (SIGSEGV) by supplying a crafted PE file to the cxxfilt utility, causing the process to crash. The vulnerability was published on December 29, 2025, and affects BinUtils version 2.26. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, GitHub PoC).

The root cause is improper input validation (CWE-20) in the C++ symbol demangling logic within cp-demangle.c. When cxxfilt processes a maliciously crafted mangled symbol name from a PE file, the call chain cplus_demangle → d_demangle → d_demangle_callback → cplus_demangle_mangled_name → d_encoding → d_bare_function_type → d_parmlist → cplus_demangle_type → d_pointer_to_member_type → d_class_enum_type → d_name → d_unqualified_name → d_abi_tags reaches line 1311 of cp-demangle.c, where a READ memory access to an invalid high-value address causes a SIGSEGV. The crash is reproducible by piping a crafted binary payload (poc6) into cxxfilt compiled with AddressSanitizer, as demonstrated in the public PoC (GitHub PoC).

Successful exploitation results in a crash of the cxxfilt (or any BinUtils tool invoking the demangler) process, causing a denial of service. There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability. In automated build pipelines or CI/CD environments that process untrusted binary files using BinUtils tools, an attacker supplying a malicious PE file could disrupt build or analysis workflows (Feedly, GitHub PoC).

A public proof-of-concept exploit (poc6) is available on GitHub, demonstrating reliable crash reproduction (GitHub PoC). The vulnerability is also indexed on Sploitus and has a Nessus detection plugin (ID 280128) (Tenable). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, threat actor attribution, or inclusion in the CISA KEV catalog at this time (Feedly).

1. Obtain the PoC payload: Download the crafted binary file poc6 from the public repository at https://github.com/caozhzh/CRGF-Vul/raw/refs/heads/main/pocs/poc6.
2. Set up a vulnerable environment: Install or compile GNU BinUtils 2.26 (e.g., using the Docker image silkeh/clang:12 with clang 12.0.1 on Debian 11 64-bit, compiled with CFLAGS="-g -Wno-error -fsanitize=address").
3. Trigger the crash: Pipe the crafted payload into the cxxfilt binary: cat poc6 | binutils/cxxfilt.
4. Observe the denial of service: The process crashes with an AddressSanitizer SIGSEGV at d_abi_tags in cp-demangle.c:1311, caused by a READ memory access to an invalid high-value address, terminating the demangler process (GitHub PoC).

• Process: Unexpected termination or crash of cxxfilt or other BinUtils tools (e.g., objdump, nm) when processing PE files; presence of core dump files associated with BinUtils processes.
• Logs: AddressSanitizer output containing SEGV on unknown address and stack trace referencing d_abi_tags in cp-demangle.c:1311; system logs showing abnormal process exits (signal 11/SIGSEGV) from BinUtils binaries.
• File System: Presence of the file poc6 or similarly crafted PE files with unusual or malformed symbol table entries in directories processed by build or analysis tools (GitHub PoC).

No official patch from GNU BinUtils maintainers has been publicly announced for this specific CVE at the time of writing. Users should upgrade to a more recent version of BinUtils beyond 2.26, as this is a very old release (2016) and many subsequent versions include demangler hardening. As a workaround, avoid processing untrusted or externally supplied PE files with BinUtils 2.26 tools, particularly cxxfilt. Organizations using automated pipelines that invoke BinUtils on untrusted input should sandbox or isolate these processes (Feedly, Tenable).

The vulnerability received limited industry attention, consistent with its narrow scope (a single old BinUtils version, DoS-only impact). It was noted in automated CVE tracking feeds including VulDB, Vulners, and INCIBE-CERT, and a Nessus detection plugin was published by Tenable (Tenable). No significant vendor statements, researcher commentary, or media coverage beyond routine CVE aggregation has been observed (Feedly).