CVE-2025-69645: 
NixOS vulnerability analysis and mitigation

CVE-2025-69645 is a denial-of-service vulnerability in GNU Binutils objdump caused by a logic error in the handling of DWARF compilation units. When processing a crafted binary with malformed DWARF debug information, an invalid offset_size value is passed to byte_get_little_endian, resulting in an abort (SIGABRT). The vulnerability was observed in Binutils 2.44 and also affects Microsoft's Azure Linux 3 package azl3_binutils_2.41-10. It was published on March 6, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (MSRC, EUVD).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), stemming from a logic error in Binutils' DWARF compilation unit parsing code. The flaw causes an invalid offset_size value to be computed and subsequently used in the byte_get_little_endian function, triggering an assertion failure and SIGABRT. Exploitation requires local access and user interaction — specifically, a victim must run objdump against a maliciously crafted binary file containing malformed DWARF debug information. The upstream bug report is tracked at the GNU Binutils Bugzilla (GNU Bugzilla), and a fix commit is available in the Binutils Git repository (GNU Git).

Successful exploitation causes the objdump process to crash (SIGABRT), resulting in a denial of service for any workflow relying on objdump to inspect binary files. There is no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local system and the objdump process itself, with no evidence of lateral movement potential or data exposure risk (MSRC, EUVD).

No confirmed exploit code or proof-of-concept is publicly available; the Bugzilla reference was analyzed and found to contain no exploit details. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is extremely low at 0.000180, reflecting minimal exploitation probability (EUVD, GNU Bugzilla).

1. Craft malicious binary: Create or obtain a binary file containing malformed DWARF debug information designed to produce an invalid offset_size value during compilation unit parsing.
2. Deliver the file: Place the crafted binary in a location accessible to the target user (e.g., via a shared directory, download, or social engineering).
3. Trigger objdump execution: Induce the victim to run objdump against the malicious file, for example: objdump -W malicious.elf or objdump -d malicious.elf.
4. Crash occurs: The DWARF parsing logic computes an invalid offset_size, which is passed to byte_get_little_endian, triggering an assertion failure and causing objdump to abort with SIGABRT, resulting in a denial of service (GNU Bugzilla, EUVD).

• Process: Unexpected termination of objdump with a SIGABRT signal; core dump files generated in the working directory (e.g., core or core.<pid>).
• Logs: System logs (e.g., /var/log/syslog or journalctl) showing entries like objdump: Aborted (core dumped) or kernel messages referencing SIGABRT from the objdump process.
• File System: Presence of unexpected or suspicious binary files (e.g., with malformed ELF/DWARF structures) in directories processed by objdump; core dump files left behind after crashes.

Update GNU Binutils to a version containing the upstream fix, referenced in commit cdb728d4da6184631989b192f1022c219dea7677 in the Binutils Git repository. Microsoft has issued a patch for the affected Azure Linux 3 package (azl3_binutils_2.41-10). As a workaround, restrict the use of objdump to trusted, validated binary files and avoid processing untrusted or externally sourced binaries with DWARF debug information. Fedora users should apply the available updates for the insight and mingw-binutils packages (MSRC, GNU Git).