CVE-2025-69650 - binutils: double free in readelf via crafted ELF binary with malformed relocation data

Back Back to CVE browser

HIGH

binutils: double free in readelf via crafted ELF binary with malformed relocation data

Published Mar 6, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.52%

Description

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

Affected products

Red Hat Hardened Images

binutils-main-2.45.1-5.hum1

Fixed · RHSA-2026:7098
Red Hat Enterprise Linux 10

binutils

Fix deferred
Red Hat Enterprise Linux 10

gcc-toolset-15-binutils

Fix deferred
Red Hat Enterprise Linux 10

gdb

Fix deferred
Red Hat Enterprise Linux 10

mingw-binutils

Fix deferred
Red Hat Enterprise Linux 6

binutils

Fix deferred
Red Hat Enterprise Linux 7

binutils

Fix deferred
Red Hat Enterprise Linux 7

gdb

Fix deferred
Red Hat Enterprise Linux 8

binutils

Fix deferred
Red Hat Enterprise Linux 8

gcc-toolset-14-binutils

Fix deferred
Red Hat Enterprise Linux 8

gcc-toolset-14-gdb

Fix deferred
Red Hat Enterprise Linux 8

gcc-toolset-15-binutils

Fix deferred
Red Hat Enterprise Linux 8

gcc-toolset-15-gdb

Fix deferred
Red Hat Enterprise Linux 8

gdb

Fix deferred
Red Hat Enterprise Linux 8

mingw-binutils

Fix deferred
Red Hat Enterprise Linux 9

binutils

Fix deferred
Red Hat Enterprise Linux 9

gcc-toolset-14-binutils

Fix deferred
Red Hat Enterprise Linux 9

gcc-toolset-15-binutils

Fix deferred
Red Hat Enterprise Linux 9

gdb

Fix deferred
Red Hat Enterprise Linux 9

mingw-binutils

Fix deferred
Red Hat OpenShift Container Platform 4

rhcos

Fix deferred

Product	Package	State	Advisory
Red Hat Hardened Images	binutils-main-2.45.1-5.hum1	Fixed	RHSA-2026:7098
Red Hat Enterprise Linux 10	binutils	Fix deferred	n/a
Red Hat Enterprise Linux 10	gcc-toolset-15-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 10	gdb	Fix deferred	n/a
Red Hat Enterprise Linux 10	mingw-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 6	binutils	Fix deferred	n/a
Red Hat Enterprise Linux 7	binutils	Fix deferred	n/a
Red Hat Enterprise Linux 7	gdb	Fix deferred	n/a
Red Hat Enterprise Linux 8	binutils	Fix deferred	n/a
Red Hat Enterprise Linux 8	gcc-toolset-14-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 8	gcc-toolset-14-gdb	Fix deferred	n/a
Red Hat Enterprise Linux 8	gcc-toolset-15-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 8	gcc-toolset-15-gdb	Fix deferred	n/a
Red Hat Enterprise Linux 8	gdb	Fix deferred	n/a
Red Hat Enterprise Linux 8	mingw-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 9	binutils	Fix deferred	n/a
Red Hat Enterprise Linux 9	gcc-toolset-14-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 9	gcc-toolset-15-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 9	gdb	Fix deferred	n/a
Red Hat Enterprise Linux 9	mingw-binutils	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	rhcos	Fix deferred	n/a

Remediation

Red Hat statement

This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this double free vulnerability is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with readelf. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Red Hat mitigation

To mitigate this vulnerability, do not process untrusted, unverified or externally supplied ELF binaries with the readelf program.

Weaknesses (1)

CWE-415

References (10)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-69650		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445293		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208346		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-69650
https://sourceware.org/bugzilla/show_bug.cgi?id=33698		exploitThird Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=33700
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=81e90cf63a10ad11772c2437c8f2a88f1a00c739
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=ea4bc025abdba85a90e26e13f551c16a44bfa92
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea4bc025abdba85a90e26e13f551c16a44bfa921		Patch
https://www.cve.org/CVERecord?id=CVE-2025-69650