CVE-2025-0840

low-risk

Published 2025-01-29

A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.

Do I need to act?

0.10% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.0/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Binutils

Affected Vendors

Gnu

References (7)

Broken Link https://sourceware.org/bugzilla/attachment.cgi?id=15882

Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32560

Patch https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=baac6c221e9d69335bf41...

Permissions Required https://vuldb.com/?ctiid.293997

Third Party Advisory https://vuldb.com/?id.293997

Exploit https://vuldb.com/?submit.485255

Product https://www.gnu.org/

/ 100

low-risk

Severity 16/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal