CVE-2025-8225

What it actually does

Local memory leak triggered in the process_debug_info function within the DWARF section handler when processing crafted input.

Why it matters to the business

Developers and build systems using affected versions may experience increased memory consumption or crashes when handling binaries with debug sections, raising operational costs and potential disruption in CI/CD pipelines; the issue remains unexploited in the wild with low and slowly rising exploit likelihood.

How an attack unfolds

An attacker with local access supplies a binary containing specially crafted DWARF debug information to the vulnerable binary utilities, causing repeated allocations that are never freed and exhausting available memory on the host.

How to fix it

Update to a version containing commit e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4 or later; rebuild affected packages from the patched source if pre-built binaries are unavailable.

How to confirm the fix worked

Confirm the presence of the fix commit in the source tree, then execute regression tests with known triggering DWARF inputs to verify absence of unbounded allocation growth.

Typical attack path

1. Obtain local execution access to a system running vulnerable Binutils
2. Prepare or obtain a binary file containing malformed DWARF sections
3. Invoke a Binutils tool such as objdump or readelf against the file
4. Observe progressive memory growth until the process terminates or the system is impacted

How to detect it

Review process accounting logs and memory usage metrics for Binutils tools on systems that process external binaries; look for repeated invocations of objdump, readelf, or similar utilities that correlate with unexpected memory spikes.

What your security team should do

• Prioritize patching build and analysis hosts that process untrusted binaries
• Restrict execution of Binutils utilities on untrusted inputs via sandboxing or user restrictions until updated
• Monitor EPSS trend and any new exploit publications given the 456 days since disclosure