Log in Start free

Vulnerability · Published Oct 16, 2025 · Assigned by VulDB

CVE-2025-11840GNU Binutils ldmisc.c vfinfo out-of-bounds

Low 3.3

In plain English

A low-severity out-of-bounds read in Binutils from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 79.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12binutilsno fix listedDEBIAN-CVE-2025-11840
Debian:13binutilsno fix listedDEBIAN-CVE-2025-11840
Debian:14binutils2.46-1DEBIAN-CVE-2025-11840
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.11USN-7899-1
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.11UBUNTU-CVE-2025-11840
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.7USN-7899-1
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.7UBUNTU-CVE-2025-11840
Ubuntu:25.10binutils2.45-7ubuntu1.1UBUNTU-CVE-2025-11840
Ubuntu:25.10binutils2.45-7ubuntu1.1USN-7899-1

Affected products (as reported)

VendorProductVersions
GNU Binutils 2.45

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References