CVE-2025-11413
published 2025-10-07CVE-2025-11413: A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The…
PriorityP424medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.5th percentile
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | binutils | < binutils 2.46-1 (forky) | binutils 2.46-1 (forky) |
| gnu | binutils | — | — |
| gnu | binutils | >= 0 < 2.46-1 | 2.46-1 |
| gnu | binutils | >= 0 < 2.38-4ubuntu2.12 | 2.38-4ubuntu2.12 |
| gnu | binutils | >= 0 < 2.42-4ubuntu2.8 | 2.42-4ubuntu2.8 |
| gnu | binutils | >= 0 < 2.45-7ubuntu1.2 | 2.45-7ubuntu1.2 |
| gnu | binutils | >= 0 < 2.24-5ubuntu14.2+esm8 | 2.24-5ubuntu14.2+esm8 |
| gnu | binutils | >= 0 < 2.26.1-1ubuntu1~16.04.8+esm14 | 2.26.1-1ubuntu1~16.04.8+esm14 |
| gnu | binutils | >= 0 < 2.30-21ubuntu1~18.04.9+esm13 | 2.30-21ubuntu1~18.04.9+esm13 |
| gnu | binutils | >= 0 < 2.34-6ubuntu1.11+esm2 | 2.34-6ubuntu1.11+esm2 |
| msrc | azl3_binutils_2.41-7_on_azure_linux_3.0 | — | — |
| msrc | cbl2_binutils_2.37-16_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_binutils_2.37-17_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_gdb_11.2-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_gdb_11.2-7_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
osv4.8MEDIUM
vendor_debian4.8LOW
vendor_redhat4.8MEDIUM
vendor_msrc3.3LOW
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
binutils vulnerabilities
osv·2025-12-10·CVSS 4.8
CVE-2025-11081 [MEDIUM] binutils vulnerabilities
binutils vulnerabilities
It was discovered that GNU binutils' dump_dwarf_section function could be
manipulated to perform an out-of-bounds read. A local attacker could
possibly use this issue to cause GNU binutils to crash, resulting in a
denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-11081)
It was discovered that GNU binutils incorrectly handled certain files. A
local attacker could possibly use this issue to cause a crash or execute
arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 25.10.
(CVE-2025-11082)
It was discovered that GNU binutils incorrectly handled certain inputs. A
local attacker could possibly use this issue to cause a crash or execute
arbitrary code. This issue was only fixed
GHSA
GHSA-w337-wphv-g4vh: A vulnerability was found in GNU Binutils 2
ghsa_unreviewed·2025-10-08
CVE-2025-11413 [MEDIUM] CWE-119 GHSA-w337-wphv-g4vh: A vulnerability was found in GNU Binutils 2
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
OSV
CVE-2025-11413: A vulnerability was found in GNU Binutils 2
osv·2025-10-07·CVSS 4.8
CVE-2025-11413 [MEDIUM] CVE-2025-11413: A vulnerability was found in GNU Binutils 2
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
Ubuntu
GNU binutils vulnerabilities
vendor_ubuntu·2025-12-10·CVSS 3.3
CVE-2025-11412 [LOW] GNU binutils vulnerabilities
Title: GNU binutils vulnerabilities
Summary: Several security issues were fixed in GNU binutils.
It was discovered that GNU binutils' dump_dwarf_section function could be
manipulated to perform an out-of-bounds read. A local attacker could
possibly use this issue to cause GNU binutils to crash, resulting in a
denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-11081)
It was discovered that GNU binutils incorrectly handled certain files. A
local attacker could possibly use this issue to cause a crash or execute
arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 25.10.
(CVE-2025-11082)
It was discovered that GNU binutils incorrectly handled certain inputs. A
local attacker could possibly use this iss
Microsoft
GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
vendor_msrc·2025-10-14·CVSS 3.3
CVE-2025-11413 [MEDIUM] CWE-125 GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
VulDB: VulDB
Customer Action Required: Yes
Red Hat
binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
vendor_redhat·2025-10-07·CVSS 4.8
CVE-2025-11413 [MEDIUM] CWE-787 binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds write in the bfd_putl64 function in the bfd/libbfd.c file due to an improper check, causing a crash and resulting in a denial of
Debian
CVE-2025-11413: binutils - A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_lin...
vendor_debian·2025·CVSS 4.8
CVE-2025-11413 [MEDIUM] CVE-2025-11413: binutils - A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_lin...
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.46-1)
sid: resolved (fixed in 2.46-1)
trixie: open
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
blogs_bleepingcomputer·2025-10-14·CVSS 7.8
[HIGH] Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Lawrence Abrams
80 Elevation of Privilege Vulnerabilities
11 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
28 Information Disclosure Vulnerabilities
11 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released today by Microsoft. Therefore, the number of flaws does not include those fixed in Azure, Mariner, Microsoft Edge, and other vulnerabilities earlier this month.
Notably, Windows 10 reaches the end of support today , with this being the last Patch Tuesday where Microsoft provides free security updates to the venerable operating system.
To continue receiving security upd
Bugzilla
CVE-2025-11413 binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
bugzilla·2025-10-07·CVSS 4.8
CVE-2025-11413 [MEDIUM] CVE-2025-11413 binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
CVE-2025-11413 binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
https://sourceware.org/bugzilla/attachment.cgi?id=16362https://sourceware.org/bugzilla/show_bug.cgi?id=33452https://sourceware.org/bugzilla/show_bug.cgi?id=33456#c10https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0https://vuldb.com/?ctiid.327349https://vuldb.com/?id.327349https://vuldb.com/?submit.665587https://vuldb.com/?submit.665590https://www.gnu.org/https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlhttps://sourceware.org/bugzilla/show_bug.cgi?id=33452
2025-10-07
Published