GNU Binutils CVE-2025-11412

Exploitation requires the following concrete conditions: (1) GNU Binutils 2.45 must be installed and in use (typically as the system linker or explicitly invoked); (2) the attacker must have local access to the system with at least standard unprivileged user privileges (PR:L per CVSS vector), sufficient to execute the linker command and provide input files; (3) a specially crafted ELF object file containing malformed virtual table entries must be processed by the linker's garbage collection mechanism, which occurs during normal linking with optimization flags enabled (not a non-default configuration, but requires the linker to process a malicious input file the attacker controls or influences). The vulnerability does NOT require elevated privileges, remote network access, user interaction beyond invoking the linker normally, or non-standard build configurations. Exploitation is limited to local attackers due to the AV:L attack vector and contingent on the linker being invoked against attacker-controlled or compromised object files.

Multiple signals indicate minimal real-world risk despite public POC availability. CVSS vector AV:L/AC:L/PR:L/UI:N shows local authentication requirement (PR:L), eliminating remote exploitation and requiring an attacker with at least unprivileged local access (such as a standard user account on a system running binutils). The extremely low CVSS score (1.9) and EPSS percentile (7%, equivalently 0.03% exploitation probability) strongly diverge from typical high-severity buffer overflow concerns, driven by the VA:L (availability impact: low) rating - the out-of-bounds read causes no confidentiality loss (VC:N) and no integrity impact (VI:N), suggesting it triggers a graceful error or non-critical memory fault rather than reliable code execution. No KEV listing confirms this is not actively exploited in targeted campaigns. The presence of publicly available POC code does not translate to widespread weaponization or adoption. Developers and build system administrators using Binutils 2.45 should treat this as a moderate maintenance issue rather than an emergency, particularly if they are not actively running the linker in untrusted user environments. The vulnerability is most concerning in multi-tenant or shared development systems where unprivileged users compile code.

An unprivileged local user on a shared development system crafts a malicious ELF object file containing specially constructed virtual table records that trigger an out-of-bounds read when processed by the Binutils linker during a build operation. The attacker submits this file as part of a build dependency or via a compromised source code repository, causing a developer or automated build system (running with user privileges) to invoke the vulnerable linker function. The out-of-bounds read is triggered during link-time garbage collection, potentially causing the linker to crash (denial of service) or read sensitive data from adjacent memory, though real-world data exfiltration via this vector has not been demonstrated.