GNU Binutils CVE-2025-11413

Local authenticated access is required (AV:L, PR:L)-attacker must be a local system user or have the ability to place a file on the target system. The linker must be invoked to process the attacker-supplied malformed ELF object file, typically during a build or linking operation. No special product configuration is required beyond standard binutils installation. Exploitation does not occur through default system usage; it requires explicit action to compile or link code that processes the malicious file. Systems that only execute pre-built binaries and do not perform local compilation or linking are not at risk. Non-developer systems and production environments that do not rebuild software are unlikely to encounter this vulnerability.

This vulnerability presents very low real-world exploitation risk despite public POC availability. The CVSS v4.0 score of 1.9 with AV:L (local attack vector) and PR:L (low privilege requirement) indicates a localized threat requiring authenticated local access and user action to supply a malicious object file. The EPSS score of 0.03% (7th percentile) strongly contradicts any assumption of widespread exploitation-this metric suggests the vulnerability lacks conditions for mass exploitation (no network vector, requires specific development workflow, limited harm scope). The impact vector shows VA:L (availability impact, low) with VC:N, VI:N, SI:N, SA:N-meaning no confidentiality, integrity impact on the vulnerable component or system, or availability impact on the system itself. The POC is publicly available (E:P in CVSS), which explains why the vulnerability was disclosed, but this alone does not elevate risk given the severe constraints on exploitation. The primary risk is to developers and build systems that process untrusted or compromised ELF files during compilation or linking; end-user systems are not directly affected unless they re-link software. No KEV status or active exploitation in the wild is indicated.

A developer or build system processes a malformed ELF object file, either provided by an external library, downloaded from an untrusted repository, or uploaded as part of a third-party plugin. When the linker invokes elf_link_add_object_symbols to parse the file's symbol table, the out-of-bounds read is triggered, causing the linker to either crash (denial of service) or disclose memory contents in error messages. In a CI/CD context, a compromised dependency or supply-chain attack could inject a malicious object file that causes build failures or exposes debug information. Exploit code is publicly available (sourceware.org bugzilla references), but exploitation requires intentional processing of the malicious file.