CVE-2025-1372

low-risk

Published 2025-02-17

A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Elfutils

Affected Vendors

Elfutils Project

References (8)

Exploit https://sourceware.org/bugzilla/attachment.cgi?id=15927

Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32656

Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32656#c3

Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32657

Permissions Required https://vuldb.com/?ctiid.295981

Third Party Advisory https://vuldb.com/?id.295981

Third Party Advisory https://vuldb.com/?submit.496485

Product https://www.gnu.org/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal