CVE-2025-0840

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0840
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0840.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-0840
Downstream
Related
Published
2025-01-29T20:00:11.944Z
Modified
2026-07-24T04:00:48.559237432Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
GNU Binutils objdump.c disassemble_bytes stack-based overflow
Details

A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.

Database specific 
{
    "cwe_ids": [
        "CWE-119",
        "CWE-121"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0840.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.1"
                },
                {
                    "last_affected": "2.1"
                },
                {
                    "introduced": "2.2"
                },
                {
                    "last_affected": "2.2"
                },
                {
                    "introduced": "2.3"
                },
                {
                    "last_affected": "2.3"
                },
                {
                    "introduced": "2.5"
                },
                {
                    "last_affected": "2.5"
                },
                {
                    "introduced": "2.6"
                },
                {
                    "last_affected": "2.6"
                },
                {
                    "introduced": "2.7"
                },
                {
                    "last_affected": "2.7"
                },
                {
                    "introduced": "2.8"
                },
                {
                    "last_affected": "2.8"
                },
                {
                    "introduced": "2.9"
                },
                {
                    "last_affected": "2.9"
                }
            ]
        }
    ]
}
References

Affected packages

Git / sourceware.org/git/binutils-gdb.git

Affected ranges

Type
GIT
Repo
https://sourceware.org/git/binutils-gdb.git
Events
Introduced
334d7f9db07cc1a817521296aafd9501bb020b82
Fixed
815d9a14cbbb3b81843f7566222c87fb22e7255d
Database specific 
{
    "cpe": "cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.4"
        },
        {
            "last_affected": "2.4"
        },
        {
            "introduced": "2.10"
        },
        {
            "last_affected": "2.10"
        },
        {
            "introduced": "2.11"
        },
        {
            "last_affected": "2.11"
        },
        {
            "introduced": "2.12"
        },
        {
            "last_affected": "2.12"
        },
        {
            "introduced": "2.13"
        },
        {
            "last_affected": "2.13"
        },
        {
            "introduced": "2.14"
        },
        {
            "last_affected": "2.14"
        },
        {
            "introduced": "2.15"
        },
        {
            "last_affected": "2.15"
        },
        {
            "introduced": "2.16"
        },
        {
            "last_affected": "2.16"
        },
        {
            "introduced": "2.17"
        },
        {
            "last_affected": "2.17"
        },
        {
            "introduced": "2.18"
        },
        {
            "last_affected": "2.18"
        },
        {
            "introduced": "2.19"
        },
        {
            "last_affected": "2.19"
        },
        {
            "introduced": "2.20"
        },
        {
            "last_affected": "2.20"
        },
        {
            "introduced": "2.21"
        },
        {
            "last_affected": "2.21"
        },
        {
            "introduced": "2.22"
        },
        {
            "last_affected": "2.22"
        },
        {
            "introduced": "2.23"
        },
        {
            "last_affected": "2.23"
        },
        {
            "introduced": "2.24"
        },
        {
            "last_affected": "2.24"
        },
        {
            "introduced": "2.25"
        },
        {
            "last_affected": "2.25"
        },
        {
            "introduced": "2.26"
        },
        {
            "last_affected": "2.26"
        },
        {
            "introduced": "2.27"
        },
        {
            "last_affected": "2.27"
        },
        {
            "introduced": "2.28"
        },
        {
            "last_affected": "2.28"
        },
        {
            "introduced": "2.29"
        },
        {
            "last_affected": "2.29"
        },
        {
            "introduced": "2.30"
        },
        {
            "last_affected": "2.30"
        },
        {
            "introduced": "2.31"
        },
        {
            "last_affected": "2.31"
        },
        {
            "introduced": "2.32"
        },
        {
            "last_affected": "2.32"
        },
        {
            "introduced": "2.33"
        },
        {
            "last_affected": "2.33"
        },
        {
            "introduced": "2.34"
        },
        {
            "last_affected": "2.34"
        },
        {
            "introduced": "2.35"
        },
        {
            "last_affected": "2.35"
        },
        {
            "introduced": "2.36"
        },
        {
            "last_affected": "2.36"
        },
        {
            "introduced": "2.37"
        },
        {
            "last_affected": "2.37"
        },
        {
            "introduced": "2.38"
        },
        {
            "last_affected": "2.38"
        },
        {
            "introduced": "2.39"
        },
        {
            "last_affected": "2.39"
        },
        {
            "introduced": "2.40"
        },
        {
            "last_affected": "2.40"
        },
        {
            "introduced": "2.41"
        },
        {
            "last_affected": "2.41"
        },
        {
            "introduced": "2.42"
        },
        {
            "last_affected": "2.42"
        },
        {
            "introduced": "2.43"
        },
        {
            "last_affected": "2.43"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.44"
        }
    ]
}

Affected versions

2.*
2.0
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.19
2.20
2.21
2.22
2.23
2.24
2.25
2.26
2.27
2.28
2.29
2.30
2.31
2.32
2.33
2.34
2.35
2.36
2.37
2.38
2.39
2.4
2.40
2.41
2.42
2.43

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0840.json"