GNU Binutils CVE-2025-11840

Exploitation requires local authenticated access (user account on target system per CVSS PR:L). The attacker must invoke the GNU Binutils linker (ld) or trigger it indirectly through build tools, with input that causes the vfinfo function in ldmisc.c to perform an out-of-bounds read. This is not a default-configuration vulnerability-typical compilation workflows are unlikely to trigger the vulnerable code path unless the linker encounters malformed input during the diagnostic phase. The vulnerability is limited to systems where an authenticated user can execute the linker with untrusted inputs or where build processes automatically invoke the linker on adversary-controlled object files.

This vulnerability presents low real-world risk despite public POC availability. The CVSS vector AV:L/AC:L/PR:L indicates local authenticated access is required-an attacker must have a user account on the target system. The impact is strictly availability-scoped (VA:L), meaning the out-of-bounds read can only degrade system availability, not cause remote code execution or privilege escalation. The EPSS score of 0.03% (percentile 8%) suggests minimal exploitation in practice, likely because the specific conditions triggering the vulnerability require deliberate linker invocation with crafted input. The E:P designation (proof-of-concept exists) confirms public code is available, but this has not translated to widespread exploitation, indicating the vulnerability requires either accidental discovery during normal linker operations or targeted deployment. Organizations should prioritize patching based on whether their workflows involve untrusted or adversarial linker inputs, but this is not a critical priority for typical development environments.

A local user with system access crafts a malicious object file or invokes the linker with specially constructed input that triggers the out-of-bounds read in the vfinfo function during error message formatting. The attacker reads adjacent memory contents to gather information about the system or unrelated data, potentially enabling a follow-up attack. Public POC code reduces the barrier to exploitation, though successful exploitation requires understanding of linker internals and deliberate triggering of the vulnerable code path.