CVE-2025-1352

GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption

State: Published
Severity: 2.3 Low
Published: Feb 16, 2025
Updated: Jun 2, 2026
Reserved: Feb 15, 2025

Description

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L	VulDB
3.0	5.0 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L	VulDB
2.0	5.1 Medium	AV:N/AC:H/Au:N/C:P/I:P/A:P	VulDB

Weaknesses

CWE-119 Memory Corruption

Affected Products

Product	Versions
elfutilsGNU	0.192Affected

References

VDB-295960 | GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruptionvdb-entrytechnical-description
VDB-295960 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #495965 | GNU elfutils/eu-readelf 0.192 illegal read accessthird-party-advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=32650issue-tracking
https://sourceware.org/bugzilla/attachment.cgi?id=15923exploit
https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2issue-trackingpatch
https://www.gnu.org/product
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.