🛡️ CVE-2025-1352 on Ubuntu — elfutils

Distribution advisory

This page covers CVE-2025-1352 as tracked by Ubuntu, for the package elfutils. No fixed version has been recorded for this distribution yet.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. A user must be tricked into taking some action. Rated impact: confidentiality low, integrity low, availability low.

CVSS metrics in full

The score comes from this vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

• Attack vector: Network — reachable from anywhere that can route to the service.
• Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
• Attack requirements: None — no deployment-specific condition has to hold.
• Privileges required: None — an unauthenticated stranger can try it.
• User interaction: Passive — a victim action is involved, but not a deliberate one.
• Confidentiality impact: Low — limited, and the attacker does not choose what is affected.
• Integrity impact: Low — limited, and the attacker does not choose what is affected.
• Availability impact: Low — limited, and the attacker does not choose what is affected.

Weakness class

UBUNTU-CVE-2025-1352 is classified as CWE-119: Improper Restriction of Operations within Memory Buffer Bounds. A read or write is performed without confirming it stays inside the allocated buffer, corrupting adjacent memory.

Affected software

UBUNTU-CVE-2025-1352 is recorded against 1 package.

• elfutils

Timeline and source

Published on 16 February 2025 and last revised on 20 May 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

ubuntu.com (Report)
www.cve.org (Report)
vuldb.com (Report)
vuldb.com (Report)
vuldb.com (Report)

Other advisories for this package

elfutils has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CLSA-2025-1766501126 (published 23 Dec 2025)
• CLSA-2025-1765289483 (published 9 Dec 2025)
• SUSE-SU-2025:4092-1 (published 24 Nov 2025)
• SUSE-RU-2025:4092-1 (published 24 Nov 2025)
• ECHO-2432-c998-4fa8 (published 15 Sep 2025)
• ECHO-2179-0037-6b90 (published 15 Sep 2025)
• ECHO-162b-a196-2f83 (published 15 Sep 2025)
• ECHO-dcfb-4448-0792 (published 15 Sep 2025)

Same weakness in other software

These advisories are the same class of weakness (CWE-119: Improper Restriction of Operations within Memory Buffer Bounds) in other software:

• CVE-2017-12862 (8.0 High, published 9 Jul 2026)
• CVE-2017-12601 (8.0 High, published 9 Jul 2026)
• CVE-2022-1941 (8.0 High, published 7 Jul 2026)
• CVE-2013-4179 (published 6 Jul 2026)
• CVE-2013-4155 (published 6 Jul 2026)
• CVE-2013-0270 (published 2 Jul 2026)
• CVE-2022-33162 (7.3 High, published 16 Aug 2024)
• CVE-2022-33267 (6.7 Medium, published 6 Jun 2023)

CVE-2025-1352 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References