PT-2025-41191 · Gnu+5 · Gnu Binutils+5

Published 2025-09-18 · Updated 2026-04-20 · CVE-2025-11412

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.45

Description A flaw exists within the Linker component of GNU Binutils 2.45, specifically in the bfd elf gc record vtentry function located in the bfd/elflink.c file. This issue allows for an out-of-bounds read. Local access is required for exploitation. The exploit details have been publicly disclosed.

Recommendations Apply the patch with identifier 047435dd988a3975d40c6626a8f739a0b2e154bc.

Exploit

Fix

DoS

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

AZL-68376

AZL-68394

AZL-68403

BDU:2025-14400

CVE-2025-11412

ECHO-F627-7DA2-5CEA

OESA-2025-2624

OESA-2025-2625

OESA-2025-2626

OESA-2025-2627

OESA-2025-2628

OESA-2025-2629

OPENSUSE-SU-2025:15651-1

OPENSUSE-SU-2025:20150-1

RHSA-2026:7098

SUSE-SU-2025:21195-1

SUSE-SU-2025:21197-1

SUSE-SU-2025:4096-1

USN-7919-1

Affected Products

Debian

Gnu Binutils

Linuxmint

Red Os

Suse

Ubuntu

References · 123

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33452 · Exploit
• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=16378 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33452#c8 · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2025-11412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11840 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11412 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11082 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-68403 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11494 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11412 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2629 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11495 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11414 · Vendor Advisory