GNU Binutils
CVE-2025-11494
LOW
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local system access with limited privileges
-
DeliveryCraft malformed x86 ELF binary or object file
-
ExploitSupply crafted file to GNU linker (ld)
-
ExecutionTrigger _bfd_x86_elf_late_size_sections out-of-bounds read
-
PersistLinker process crashes or reads invalid memory
-
ImpactBuild failure or system log anomaly
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the system and a user account with sufficient privileges to execute the linker (PR:L - limited privileges, likely a build user or developer account). The attacker must supply a specially crafted ELF binary or object file as input to the linker; this cannot be triggered remotely or via default tool operations on standard inputs. The vulnerability is triggered only during the late-stage size-calculation phase of ELF x86 linking, meaning only certain malformed binaries will reliably trigger the out-of-bounds read. No privilege escalation or remote attack vector exists; the impact is limited to denial of service (linker crash) within the local user's session. |
| Impact | Despite publicly available exploit code, real-world risk is exceptionally low. CVSS 1.9 reflects the limited scope: local-only attack vector (AV:L), authenticated access required (PR:L), and only availability impact (VA:L) with no confidentiality or integrity effects (VC:N/VI:N). EPSS 0.03% (10th percentile) indicates this is among the least likely-to-exploit vulnerabilities, even accounting for POC availability. The combination of local-only access, authentication requirement, and minimal impact (no data disclosure or code execution) means this affects only developers or system administrators with legitimate access to the linker on shared systems. The vulnerability is not in CISA KEV, confirming no active exploitation in the wild despite POC availability. This is a low-priority issue suitable for standard patching schedules rather than urgent response, though automated build systems using Binutils 2.45 should apply the patch to prevent availability disruption during compilation. |
| Exploit ScenarioDerived | A system administrator or developer with local access to a shared build system runs the linker (ld) with a specially crafted ELF binary or object file. The malformed input triggers an out-of-bounds memory read in _bfd_x86_elf_late_size_sections, causing the linker process to crash or enter an unstable state, interrupting compilation workflows. The public exploit code demonstrates this crash condition reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 29, 2026
Out-of-bounds read in GNU Binutils 2.45 linker component allows local authenticated attackers to trigger memory access violations via crafted input to the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c. The vulnerability has publicly available exploit code and requires local access with limited privileges; real-world impact is minimal availability loss (CVSS 1.9, EPSS 0.03%) rather than confidentiality or integrity compromise.
RemediationAI
Apply the vendor-released patch identified as commit b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a from the binutils-gdb Git repository (https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a). Users should upgrade Binutils to the next stable release following 2.45 or apply the patch directly to their 2.45 installation. For systems using Binutils 2.45 only in automated build pipelines, restricting linker execution to unprivileged service accounts is not recommended as a workaround due to legitimate linker privilege requirements; instead, prioritize timely patching. Distributions and package maintainers should integrate this patch into their Binutils 2.45 point releases or advise users to upgrade to newer stable versions (2.46 or later, if available).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU Binutils is a collection of binary tools including the linker (ld), assembler (as), and object file utilities. The vulnerability exists in the ELF x86 linker backend, specifically in the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c, which handles section sizing during the late stages of ELF linking. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates the function fails to validate memory access boundaries when processing x86 ELF sections, likely during size calculation or relocation processing. This is a buffer overflow variant affecting the linker's internal data structures rather than heap or stack.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
GitHub PoC
Exploit-DB