Vulnerability · Published Sep 27, 2025 · Assigned by VulDB
CVE-2025-11082GNU Binutils Linker elf-eh-frame.c _bfd_elf_parse_eh_frame heap-based overflow
Medium 5.3
In plain English
A medium-severity heap buffer overflow in Binutils from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | binutils | 2.41-58.el10_1.2.alma.1 | ALSA-2025:23306 |
| AlmaLinux:10 | binutils-devel | 2.41-58.el10_1.2.alma.1 | ALSA-2025:23306 |
| AlmaLinux:10 | binutils-gold | 2.41-58.el10_1.2.alma.1 | ALSA-2025:23306 |
| Debian:12 | binutils | no fix listed | DEBIAN-CVE-2025-11082 |
| Debian:13 | binutils | no fix listed | DEBIAN-CVE-2025-11082 |
| Debian:14 | binutils | 2.46-1 | DEBIAN-CVE-2025-11082 |
| Rocky Linux:10 | binutils | 0:2.41-58.el10_1.2 | RLSA-2025:23306 |
| Ubuntu:22.04:LTS | binutils | 2.38-4ubuntu2.10 | USN-7847-1 |
| Ubuntu:22.04:LTS | binutils | 2.38-4ubuntu2.10 | UBUNTU-CVE-2025-11082 |
| Ubuntu:24.04:LTS | binutils | 2.42-4ubuntu2.6 | UBUNTU-CVE-2025-11082 |
| Ubuntu:24.04:LTS | binutils | 2.42-4ubuntu2.6 | USN-7847-1 |
| Ubuntu:25.10 | binutils | 2.45-7ubuntu1.2 | UBUNTU-CVE-2025-11082 |
Affected products (as reported)
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-326123 | GNU Binutils Linker elf-eh-frame.c _bfd_elf_parse_eh_frame heap-based overflow vdb-entry, technical-description
- VDB-326123 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #661276 | GNU Binutils 2.45 Heap-based Buffer Overflow third-party-advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=33464 issue-tracking
- https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2 issue-tracking
- https://sourceware.org/bugzilla/attachment.cgi?id=16358 exploit
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8 patch
- https://www.gnu.org/ product
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html