PT-2025-39749 · Gnu+4 · Gnu Binutils+4

Jjleo · Published 2025-09-19 · Updated 2026-04-20 · CVE-2025-11082

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils versions prior to 2.46

Description A flaw exists in GNU Binutils impacting the bfd elf parse eh frame function within the bfd/elf-eh-frame.c file of the Linker component. This can lead to a heap-based buffer overflow, with exploitation restricted to local execution. The exploit has been published.

Recommendations Update to version 2.46 or later.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

ALSA-2025:23306

AZL-67902

AZL-67908

AZL-67914

AZL-67922

AZL-67925

AZL-67928

BDU:2025-13243

CLEANSTART-2026-EQ25508

CVE-2025-11082

ECHO-457A-192D-9847

OESA-2025-2412

OESA-2025-2413

OESA-2025-2414

OESA-2025-2415

OESA-2025-2416

OESA-2025-2417

RHSA-2025:23306

RHSA-2025:23405

RHSA-2026:7098

USN-7847-1

USN-7919-1

Affected Products

Debian

Gnu Binutils

Linuxmint

Red Os

Ubuntu

References · 84

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33464 · Exploit
• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=16358 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2 · Exploit
• https://ubuntu.com/security/CVE-2025-11414 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-7546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11081 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-11082 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7847-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:23306 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11082 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE142 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8 · Patch