LiveActive security incident?Get immediate response
CVE Record

CVE-2025-1376: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.

LowCVSS 2.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2025-1376 is a low-severity local denial-of-service issue in GNU elfutils 0.192. A crafted local input processed by eu-strip can trigger a crash through elf_strptr. It does not indicate data theft or remote compromise, but it can disrupt build, debugging, or packaging workflows that process untrusted ELF files.

Executive priority

Handle through normal patch management unless eu-strip processes untrusted ELF files in critical build or product pipelines. There is public disclosure, but the impact is limited to local denial of service and the sources do not support active exploitation.

Technical view

The issue affects elf_strptr in libelf/elf_strptr.c as used by eu-strip in GNU elfutils 0.192. Sources describe illegal read/resource-handling behavior leading to availability impact. CVSS 3.1 is 2.5, with local attack vector, high complexity, low privileges, no user interaction, and low availability impact only.

Likely exposure

Exposure is mainly systems, CI jobs, packaging pipelines, developer workstations, and products using GNU elfutils 0.192 where eu-strip processes ELF files from less-trusted sources. Evidence provided names GNU elfutils 0.192 only; downstream package exposure must be checked through vendor or distribution advisories.

Exploitation context

A public exploit or reproducer is referenced, but the source bundle does not show CISA KEV listing or cited active exploitation. The attack is local, high complexity, and requires low privileges. Treat this as a targeted workflow-disruption risk rather than an internet-exposed breach scenario.

Researcher notes

Focus analysis on malformed ELF handling in elf_strptr as reached by eu-strip. Avoid broadening scope beyond GNU elfutils 0.192 without downstream evidence. The CVSS vector supports low operational severity, but public disclosure justifies confirming patch uptake in build and packaging environments.

Mitigation direction

  • Apply upstream patch b16f441cca0a4841050e3215a9f120a6d8aea918 or a vendor package containing it.
  • Upgrade GNU elfutils beyond affected 0.192 when vendor guidance confirms the fix.
  • Limit eu-strip processing of untrusted ELF files until patched.
  • Check distribution, product, and Siemens advisories for downstream fixed versions.
  • Keep CI and build workers patched where ELF artifacts are processed.

Validation and detection

  • Inventory systems and containers for GNU elfutils 0.192.
  • Confirm eu-strip or linked libelf packages include the referenced patch.
  • Review CI, packaging, and artifact-processing jobs for untrusted ELF input.
  • Run vendor-approved regression testing after updating elfutils.
  • Check vendor advisories for downstream product applicability.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-404: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-1376 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
6Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.5CVSS 3.1LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L11.4VulDB
2.5CVSS 3.0LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L11.4VulDB
2CVSS 4.0LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——VulDB
1CVSS 2.0LowAV:L/AC:H/Au:S/C:N/I:N/A:P1.52.9VulDB

Vulnerability scoring details

Base CVSS 4.0 score

2Low
CVSS 4.0 vector shape for CVE-2025-1376Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. Source timelineVulDB

    VulDB entry last update

  5. CVE publishedCVE Program

    The CVE record was published.

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GNUelfutils0.192Listed
Weakness

CWE details

CWE-404

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-404 · source CWE mapping

Improper Resource Shutdown or Release

Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs