CVE-2025-66866CWE-20

CVE-2025-66866

High · published December 29, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

⚠️ A simple crafted PE file can knock BinUtils 2.26 out of commission. It's like serving an exquisite dish spoiled by a single bad ingredient! 🍽️ Think of BinUtils as a restaurant in charge of preparing various meals. If a chef receives a bad ingredient, they might mistakenly ruin an entire dish, causing the restaurant to close until the problem is fixed. An attacker could exploit this vulnerability to create a denial of service, meaning legitimate users could find themselves unable to access essential services. It's like having your favorite restaurant shut down because a rogue ingredient caused a health scare – very inconvenient!

Put simply

Think of BinUtils as a restaurant in charge of preparing various meals. If a chef receives a bad ingredient, they might mistakenly ruin an entire dish, causing the restaurant to close until the problem is fixed. This vulnerability resides in the d_abi_tags function of cp-demangle.c, where crafted PE files can lead the BinUtils to crash due to an unhandled error scenario.

What to do

An attacker could exploit this vulnerability to create a denial of service, meaning legitimate users could find themselves unable to access essential services. It's like having your favorite restaurant shut down because a rogue ingredient caused a health scare – very inconvenient! To safeguard against this, update BinUtils to the latest stable version where this bug is patched. If you're using version 2.26, it's imperative to make this update a priority! You've got this! Stay vigilant and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-12-29T22:15Z
Affected products (1)
ProductVersionsFixed in
gnu/binutilsall versions—
References (2)
EPSS history
Timeline
  • 29 DEC 00:00Z
    An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file
    cvelistv5