CVE-2025-66866

A flaw was found in BinUtils. An attacker can exploit a vulnerability in the d_abi_tags function within the cp-demangle.c file by providing a specially crafted Portable Executable (PE) file. This can lead to a Denial of Service (DoS), making the affected application unavailable to legitimate users.

This vulnerability is rated Low for Red Hat products. The flaw in BinUtils allows for a denial of service when processing a specially crafted Portable Executable (PE) file. For a successful attack to take place the user needs to be tricked to process the maliciously crafted PE binary using the affected program. The consequences of a successful attack is also restricted to the single process instance reading the malicious file and does not have a system-wide effect, presenting a Low impact in the availability criteria.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid processing untrusted Portable Executable (PE) files with applications linked against BinUtils. Restricting the source of PE files to trusted origins can reduce the attack surface.