GNU Binutils CVE-2025-11839

Exploitation requires all of the following: (1) local authenticated access to a system running Binutils 2.45 specifically (PR:L in CVSS, not default-installation requirement but necessitates prior account compromise or insider); (2) ability to execute binutils tools (objdump, readelf, or indirectly via ld during linking) against attacker-controlled or modified ELF/object files with malformed debug symbols; (3) read access to the output of those tools (stdout, logs, or error messages). The vulnerability does NOT affect remote users, unprivileged local users without shell access, or systems running patched Binutils versions. Non-default configurations that increase risk: systems with debug symbols enabled (common in development but not production), automated build pipelines that process untrusted object files, or shared build environments where multiple users can interact. Default security posture (modern Linux with user/root separation, /tmp with noexec) reduces but does not eliminate risk for local authenticated attackers.

CVSS 1.9 with vectors AV:L/AC:L/PR:L indicates local unauthenticated access with low complexity but requiring prior authentication (PR:L), and impact limited to availability (VA:L) with no confidentiality or integrity impact specified. However, the vulnerability tag explicitly lists 'Information Disclosure,' creating a direct contradiction: CVSS claims no confidentiality impact (VC:N) while the CVE description and tag confirm data leakage. EPSS percentile 6 (0.02%) shows this ranks in the bottom 6% of vulnerabilities for exploitation likelihood-a critical disconnect from POC availability. This suggests the POC is either proof-of-concept in academic sense (non-weaponizable), requires precise timing/conditions not present in common deployments, or the low EPSS reflects extremely limited accessible targets. Real-world risk is LOW: the vulnerability requires local authenticated access to a system running Binutils 2.45 specifically (not inherited by default in most Linux distributions), and the information disclosure impact appears constrained to debug symbol data. Patch status and distribution lag are material factors in actual risk assessment.

A local authenticated user with shell access to a development workstation or build server running Binutils 2.45 crafts a malicious ELF binary or object file with specially formatted debug symbols that trigger the unchecked return value in tg_tag_type. When the user or an automated build process invokes objdump or readelf on this file, the parser fails to validate intermediate results, dereferencing uninitialized memory and leaking sensitive debug information (function names, variable locations, internal symbol tables) to stdout or a log file accessible to the attacker. The publicly available POC likely demonstrates this through a crafted debug object file.