CVE-2025-69652
Gnu Binutils ≤ 2.46
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-69652 is a medium-severity Improper Cleanup on Thrown Exception (CWE-460) vulnerability in Gnu Binutils. Its CVSS base score is 6.2 (Medium).
Operationally, ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and SI-17 (Fail-safe Procedures) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208348
Vulnerability Data
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate…
more
into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to fail to a known state on indicated failures, directly forcing proper state cleanup instead of leaving inconsistent state after an exception.
Mandates explicit fail-safe procedures on failures, which structurally enforces cleanup actions that the weakness omits.
Requires application of security engineering principles (e.g., fail-safe, complete mediation) during design that would eliminate improper exception cleanup.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper exception handling and resource cleanup.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing cleanup paths, thereby mitigating the weakness before deployment.
Secure SDLC mandates exception-handling and cleanup practices that reduce improper state after thrown exceptions.
Application security requirements can specify robust exception handling and resource-release rules.
Secure architecture principles include designing for safe failure and guaranteed cleanup on exceptions.
Secure coding standards directly require proper resource release and state restoration after exceptions.