CVE-2025-66864
📋 TL;DR
A vulnerability in BinUtils' cp-demangle.c allows attackers to cause denial of service through crafted PE files. This affects systems using BinUtils for binary analysis or development. The issue stems from improper input validation in the d_print_comp_inner function.
💻 Affected Systems
- BinUtils
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or unavailability of BinUtils-dependent services, potentially disrupting build pipelines or security analysis tools.
Likely Case
Application crashes when processing malicious PE files, causing temporary service disruption for tools using c++filt or related demangling functions.
If Mitigated
Limited impact with proper input validation and sandboxing of file processing operations.
🎯 Exploit Status
Proof-of-concept crash files are publicly available in GitHub repositories. Exploitation requires the attacker to provide a crafted PE file to vulnerable BinUtils tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check BinUtils repository for fixes after version 2.26
Vendor Advisory: https://sourceware.org/bugzilla/show_bug.cgi?id=[CVE-2025-66864]
Restart Required: No
Instructions:
1. Check current BinUtils version. 2. Update to patched version from official repository. 3. Recompile if using source distribution. 4. Verify fix with test cases.
🔧 Temporary Workarounds
Input Validation Filter
allImplement pre-processing validation for PE files before passing to BinUtils tools.
# Example: Use file command to verify file type before processing
file --mime-type input_file | grep -q 'application/x-dosexec' && echo 'PE file detected'
Sandbox Execution
linuxRun BinUtils tools in isolated containers or sandboxes to limit crash impact.
docker run --rm -v $(pwd):/data ubuntu binutils-command /data/input_file
firejail --net=none c++filt input_file
🧯 If You Can't Patch
- Restrict processing of untrusted PE files through BinUtils tools
- Implement monitoring and alerting for BinUtils process crashes
🔍 How to Verify
Check if Vulnerable:
Test with provided PoC files from GitHub references using c++filt or objdump on PE files.Check Version:
c++filt --version 2>&1 | head -1Verify Fix Applied:
Attempt to process PoC files with updated BinUtils; should not crash.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from c++filt, objdump, or other BinUtils processes
- Abnormal process termination with signal 11 (SIGSEGV)
Network Indicators:
- Unusual file uploads followed by BinUtils process crashes
SIEM Query:
process_name IN ('c++filt', 'objdump', 'readelf') AND exit_code = 139