An unauthenticated attacker can trigger a denial of service in GNU BinUtils 2.26 by providing a malicious PE file, which causes the application to crash.

The vulnerability resides in the d_print_comp_inner function within the cp-demangle.c source file, which fails to properly handle crafted input from a PE file. This allows an unauthenticated attacker to induce a crash, resulting in a denial of service condition.

The exploitation of this vulnerability results in a denial of service, which can disrupt critical development or compilation pipelines relying on BinUtils. With a CVSS score of 7.5, the vulnerability is rated as High because it is remotely exploitable without authentication, posing a significant risk to availability for affected systems.

Immediate Action: Since a specific patch is not currently identified, organizations should restrict access to systems that process untrusted PE files using BinUtils 2.26.

Proactive Monitoring: Monitor system logs for unexpected application crashes or segmentation faults when processing binary files.

Compensating Controls: Implement strict input validation or sandboxing for any automated systems that ingest or demangle PE files to ensure malicious files are blocked before processing.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for denial of service and the existence of a proof-of-concept, administrators should prioritize isolating systems that utilize BinUtils 2.26 for processing external PE files. Review vendor security advisories regularly for the release of a formal patch to address the underlying flaw in the cp-demangle component.