CVE-2025-5245: GNU Binutils objdump debug.c debug_type_samep memory corruption

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-27 · updated 2026-10-15
Weakness: CWE-119

Description

A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Affected products

GNU Binutils: before 2.45 — fixed in 2.45

How to fix

Upgrade to a fixed version: GNU Binutils 2.45. Check the vendor advisory for mitigations.

References

https://sourceware.org/bugzilla/attachment.cgi?id=16004
https://sourceware.org/bugzilla/show_bug.cgi?id=32829
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a
https://vuldb.com/?ctiid.310347
https://vuldb.com/?id.310347
https://vuldb.com/?submit.584635
https://www.gnu.org/
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Get alerted when CVE-2025-5245 or the next vulnerability affects your stack