Bug 2450345 - CVE-2025-66866 gdb: BinUtils: Denial of Service via crafted PE file [fedora-42]
Summary: CVE-2025-66866 gdb: BinUtils: Denial of Service via crafted PE file [fedora-42]
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: Fedora
Classification: Fedora
Component: gdb
Version: 42
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Kevin Buettner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["1724afa3-cb81-404d-8b81-7...
Depends On:
Blocks: CVE-2025-66866
TreeView+ depends on / blocked
 
Reported: 2026-03-23 14:28 UTC by Marco Benatto
Modified: 2026-03-24 19:44 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-03-24 19:44:31 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Marco Benatto 2026-03-23 14:28:57 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Kevin Buettner 2026-03-24 19:44:31 UTC
Closing, as this is not a GDB security vulnerability per the GDB Security Policy
(SECURITY.txt). A denial of service when demangling a PE file does not cross
the privilege boundaries that the GDB project considers security bugs.

Per SECURITY.txt section "What Is Not A Security Bug":
  "denial of service attacks targeting GDB itself ... are not considered a
   security bug"

and

  "simply triggering an internal error in GDB is not considered a security bug,
   since GDB has detected an issue and handled it in a non-exploitable manner."

Additionally, SECURITY.txt notes:
  "due to there being already known bugs in GDB relating to undefined behavior
   triggered from malformed programs, further bugs in this area should still be
   reported, but are unlikely to be given high priority."

While this is a legitimate bug in libiberty's cp-demangle.c (shared with binutils),
it does not warrant a CVE or special security handling. The fix will be addressed
upstream and will reach Fedora GDB through the normal release process. A backport
is not warranted given the low severity and nature of the issue.


Note You need to log in before you can comment on or make changes to this bug.