Microsoft Security Response Center Blog Alerts

CVE-2025-69645 Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

Published March 11, 2026

Information published.

CVE-2025-69652 GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.

Published March 11, 2026

Information published.

CVE-2025-69650 GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service.

Published March 11, 2026

Information published.

CVE-2025-14524 bearer token leak on cross-protocol redirect

Published March 10, 2026

Information published.

CVE-2026-3494 MariaDB Server Audit Plugin Comment Handling Bypass

Published March 10, 2026

Information published.

CVE-2025-10966 missing SFTP host verification with wolfSSH

Published March 10, 2026

Information published.

CVE-2026-22701 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

Published March 7, 2026

Information published.

CVE-2026-26122 Microsoft ACI Confidential Containers Information Disclosure Vulnerability

Published March 6, 2026

Information published.

CVE-2026-23235 f2fs: fix out-of-bounds access in sysfs attribute read/write

Published March 6, 2026

Information published.

CVE-2026-23234 f2fs: fix to avoid UAF in f2fs_write_end_io()

Published March 6, 2026

Information published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

AbuseIPDB Contributor Badge

© 2026, Network Services Group |  216.73.217.116
Contributor,  Detroit Internet Exchange