CVE-2025-0840

What it actually does

Stack-based buffer overflow in the disassemble_bytes function of binutils/objdump.c triggered by manipulation of the buf argument, allowing memory corruption when processing crafted input remotely.

Why it matters to the business

Disruption to binary analysis and reverse-engineering workflows that rely on objdump, with potential for remote code execution or denial of service in environments using affected GNU Binutils versions up to 2.43; urgency is moderate given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker supplies specially crafted binary data to objdump that overflows the stack buffer in disassemble_bytes; the public exploit requires high complexity and is difficult to execute successfully, with no known threat actors or ransomware campaigns leveraging it.

How to fix it

Upgrade GNU Binutils to version 2.44 or apply the patch identified by commit baac6c221e9d69335bf41366a1c7d87d8ab2f893 (or the equivalent 815d9a14cbbb3b81843f7566222c87fb22e7255d in the git repository).

How to confirm the fix worked

Verify installed Binutils version is 2.44 or later; confirm the patch commit is present in the source tree; re-test objdump with previously triggering inputs to ensure no overflow occurs.

Typical attack path

1. Identify target systems running objdump from Binutils <= 2.43
2. Craft malicious input file designed to overflow the buf argument in disassemble_bytes
3. Deliver the input remotely to trigger the stack-based buffer overflow
4. Attempt to leverage the resulting memory corruption for code execution or crash

How to detect it

Review system and application logs for unexpected objdump crashes or segmentation faults when processing external binaries; correlate with usage of untrusted input files around the time of any anomalous behavior.

What your security team should do

• Prioritize upgrade of Binutils to the fixed version in all build, analysis, and CI environments
• Monitor for any public exploit code updates given the disclosure status
• Restrict use of objdump on untrusted inputs until patched