GNU Binutils CVE-2025-11414

Exploitation requires local user access (AV:L) with authenticated login to the system (PR:L). The attacker must be able to invoke the GNU linker directly or indirectly through compiler commands (gcc, ld, etc.), which is typically available to all system users. The vulnerability triggers during link-time processing of specially crafted object files, so the attacker must supply or influence input to a linking operation. No special system configuration, non-default features, or elevated privileges are required beyond standard user-level shell access. The vulnerability does NOT affect systems that do not use GNU Binutils (e.g., systems using other linkers such as LLVM lld or MIPS-specific linkers) and does NOT affect machines where Binutils is not installed or where shell access is restricted.

Risk signals present a mixed picture. The CVSS score of 1.9 indicates minimal impact-no confidentiality loss (VC:N), no integrity loss (VI:N), only availability loss limited to the linker component (VA:L). The CVSS vector confirms local-only attack vector (AV:L) requiring authenticated access (PR:L), meaning unprivileged local users can trigger the vulnerability. However, EPSS score of 0.03% (7th percentile) suggests negligible real-world exploitation probability despite public POC availability, indicating this is not a practical attack vector for most deployments. The out-of-bounds read itself is unlikely to enable code execution or significant data exfiltration. This is a low-priority vulnerability suitable for routine patching rather than emergency response. Organizations using Binutils primarily as a build-time tool (not runtime) face minimal risk. The public POC does not appear to have driven actual attacks.

An unprivileged local user invokes the linker (ld) or a toolchain command that internally calls the linker (such as gcc) with specially crafted object files or linking arguments designed to trigger the out-of-bounds read in get_link_hash_entry. The linker crashes or reads adjacent memory, potentially revealing heap metadata or causing a denial of service on the build system. Publicly available POC code exists to reproduce this crash reliably.