Log in Start free

Vulnerability · Published Jul 13, 2025 · Assigned by VulDB

CVE-2025-7545GNU Binutils objcopy.c copy_section heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in Binutils from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12binutilsno fix listedDEBIAN-CVE-2025-7545
Debian:13binutilsno fix listedDEBIAN-CVE-2025-7545
Debian:14binutils2.45-3DEBIAN-CVE-2025-7545
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.10USN-7847-1
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.11USN-7899-1
Ubuntu:22.04:LTSbinutils2.38-4ubuntu2.10UBUNTU-CVE-2025-7545
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.7USN-7899-1
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.6USN-7847-1
Ubuntu:24.04:LTSbinutils2.42-4ubuntu2.6UBUNTU-CVE-2025-7545
Ubuntu:25.10binutils2.45-7ubuntu1.1USN-7899-1

Affected products (as reported)

VendorProductVersions
GNU Binutils 2.45

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References