CVE-2025-66862CWE-122

CVE-2025-66862

High · published December 29, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

⚡ A clever crafted PE file is all it takes to trigger a buffer overflow in BinUtils 2.26! 🚨 Think of it like a restaurant where an overzealous customer keeps ordering more food than the kitchen can handle, causing a chaotic overflow in the dining area. When this happens in the code, it can lead to a denial of service, leaving legitimate users waiting outside in frustration. This buffer overflow vulnerability can lead to a total service breakdown, meaning attackers could deny access to legitimate users. It's like locking the doors to a popular restaurant at peak hours—absolute chaos! If exploited, users may find themselves unable to access critical services. This could have a devastating impact on operations.

Put simply

Think of it like a restaurant where an overzealous customer keeps ordering more food than the kitchen can handle, causing a chaotic overflow in the dining area. When this happens in the code, it can lead to a denial of service, leaving legitimate users waiting outside in frustration. The vulnerability exists in the function gnu_special within cplus-dem.c in BinUtils 2.26, allowing attackers to manipulate the buffer and potentially crash the application, causing a denial of service.

What to do

This buffer overflow vulnerability can lead to a total service breakdown, meaning attackers could deny access to legitimate users. It's like locking the doors to a popular restaurant at peak hours—absolute chaos! If exploited, users may find themselves unable to access critical services. This could have a devastating impact on operations. To protect yourself, immediately upgrade BinUtils to a secure version where this vulnerability is patched. Additionally, ensure you have monitoring in place to detect any unusual activity that could indicate an attempted exploit. You've got this! Follow these steps, and you'll be safeguarding your systems in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.8th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-12-29T22:15Z
Affected products (1)
ProductVersionsFixed in
gnu/binutilsall versions—
References (1)
EPSS history
Timeline
  • 29 DEC 00:00Z
    A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file
    cvelistv5