GNU Binutils CVE-2025-11495

CRITICAL: Exploitation requires local system access with sufficient privilege to execute the linker (PR:L in CVSS vector). The attacker must control or provide a specially crafted x86-64 ELF object file (.o file) to be linked. This is NOT a remote or network-exploitable vulnerability - it only triggers during local compilation/linking activity. Exploitation cannot be automated (AT:N) and requires manual invocation of the linker by the privileged user. The vulnerability is version-specific to Binutils 2.45; other versions may not be affected. Default configurations of Binutils are vulnerable if version 2.45 is installed; no non-default settings increase or decrease risk.

Despite publicly available exploit code, real-world risk is exceptionally low based on multiple convergent signals. EPSS exploitation probability is 0.03% (7th percentile), indicating minimal practical exploitation likelihood. CVSS v4.0 vector reveals the critical limiting factor: integrity and confidentiality are completely unaffected (VI:N, VC:N), with only availability impact (VA:L). Attack vector is local-only (AV:L), requires low privileges (PR:L), and cannot be automated (AT:N, manual human interaction required). The severity misalignment - high-CVSS textual description but minimal numeric score - reflects that while a heap overflow is classically dangerous, this specific instantiation causes denial-of-service only in a build/compilation context affecting an unprivileged user's local system. This is not a priority for most production environments. Active exploitation would require an attacker with local system access and sufficient privilege to run the linker, a scenario typical only in compromised developer workstations or shared systems. The 1.9 CVSS score accurately reflects low severity despite the buffer overflow label.

A non-root user on a Linux system with GNU Binutils 2.45 installed runs the linker (ld) on a specially crafted x86-64 ELF object file. The malicious object file contains specific relocation entries that trigger improper bounds checking in elf_x86_64_relocate_section, causing a heap buffer overflow. The overflow overwrites adjacent heap memory, causing the linker process to crash (availability impact) but not executing arbitrary code or leaking sensitive data.