Critical Memory Corruption Vulnerability in GNU Binutils (CVE-2025-5245)
Summary
CVE-2025-5245: A vulnerability classified as critical has been found in GNU Binutils up to 2.44. Affects binutils versions < 2.44-r3. Fixed in 2.44-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of tools for managing binary files, including object files, archives, and executable files. It provides essential functionalities for developers, such as linking, assembling, and disassembling. The package is widely used in various software development environments, making it crucial for maintaining the integrity and security of applications. The vulnerability CVE-2025-5245 affects versions of Binutils up to 2.44, posing a significant risk due to its potential for memory corruption.
Vulnerability Detail
CVE-2025-5245 is a critical vulnerability found in the debug_type_samep function within the debug.c file of the objdump component of GNU Binutils. This vulnerability allows an attacker with local access to exploit memory corruption, which can lead to arbitrary code execution or system crashes. The exploit has been publicly disclosed, increasing the urgency for affected users to address this issue promptly.
How To Fix
Minimum fixed version
2.44-r3
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit local access to the system or restrict the execution of the objdump tool until the package is updated. This can help minimize the risk of exploitation while waiting for a patch.
Conclusion
CVE-2025-5245 represents a critical vulnerability in GNU Binutils that can lead to severe consequences if exploited. It is essential for users to update their packages promptly and consider workarounds to mitigate risks until a patch is applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software security.
See every vulnerability recorded for binutils →
FAQ
CVE-2025-5245 is a critical vulnerability in GNU Binutils that allows for memory corruption through the objdump component.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to memory corruption, arbitrary code execution, or system crashes, posing significant security risks.
Yes, a patch is available. Users should update their GNU Binutils package to a version higher than 2.44 to mitigate the vulnerability.
If immediate updates are not possible, consider restricting local access to the system or limiting the use of the objdump tool as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
