CVE-2025-1365

low-risk
Published 2025-02-17

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Elfutils Project

References (7)

Exploit https://sourceware.org/bugzilla/attachment.cgi?id=15925
Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32654
Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32654#c2
Permissions Required https://vuldb.com/?ctiid.295977
Third Party Advisory https://vuldb.com/?id.295977
Third Party Advisory https://vuldb.com/?submit.496483
Product https://www.gnu.org/
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal