GNU Binutils
CVE-2025-11839
LOW
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.
AnalysisAI
GNU Binutils 2.45 allows local privilege-escalable information disclosure through an unchecked return value in the tg_tag_type function of prdbg.c, enabling authenticated local attackers to trigger unvalidated memory reads that leak sensitive data. CVSS score of 1.9 reflects minimal impact (availability only), though publicly available exploit code exists; EPSS 0.02% indicates negligible real-world exploitation probability despite POC availability.
Technical ContextAI
GNU Binutils is a collection of binary tools including ld, as, objdump, and readelf. The vulnerability resides in prdbg.c, a debugging information handler module that processes symbol debugging data. The root cause is CWE-252 (Unchecked Return Value), where the tg_tag_type function fails to validate return values from subroutine calls, potentially leaving uninitialized or stale variables that are later dereferenced. This pattern typically occurs in C code parsing complex debug formats (DWARF, stabs) where intermediate parsing steps can fail silently, leading to information leaks when unvalidated pointers are accessed.
RemediationAI
No vendor-released patch version has been publicly identified as of the CVE publication date. Immediate mitigation requires upgrading GNU Binutils to a version newer than 2.45 if available from your distribution (check https://sourceware.org/binutils/ for release notes). As a compensating control, restrict local access to systems running Binutils 2.45 by limiting user accounts with shell login rights (this addresses AV:L/PR:L requirement), disable interactive use of objdump/readelf on untrusted debug symbols via AppArmor/SELinux confinement, or isolate development/debug toolchains to air-gapped or least-privilege containers. Note that restricting debug tool access may impair legitimate debugging workflows; enterprises should evaluate whether the information disclosure risk (limited to debug symbol leakage) outweighs operational cost. Check https://sourceware.org/bugzilla/show_bug.cgi?id=33448 for upstream fix status and backport availability.
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Same weakness CWE-252 – Unchecked Return Value
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today