PT-2025-41304 · Gnu+4 · Gnu Binutils+4

Yifan Zhang · Published 2025-09-30 · Updated 2026-04-20 · CVE-2025-11494

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.45

Description An issue exists in GNU Binutils that involves an out-of-bounds read within the bfd x86 elf late size sections function, located in the bfd/elfxx-x86.c file of the Linker component. The vulnerability is locally exploitable. The exploit has been publicly disclosed.

Recommendations Apply the patch identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

BDU:2025-16073

CVE-2025-11494

ECHO-E73F-44BF-91B5

OESA-2025-2412

OESA-2025-2413

OESA-2025-2414

OESA-2025-2415

OESA-2025-2416

OESA-2025-2417

OPENSUSE-SU-2025:15651-1

OPENSUSE-SU-2025:20150-1

RHSA-2026:7098

SUSE-SU-2025:21195-1

SUSE-SU-2025:21197-1

SUSE-SU-2025:4096-1

USN-7919-1

Affected Products

Debian

Gnu Binutils

Linuxmint

Suse

Ubuntu

References · 116

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33499 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2 · Exploit
• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=16389 · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-11494 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4096-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2416 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2415 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11494 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11494 · Security Note
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a · Patch
• https://osv.dev/vulnerability/OESA-2025-2414 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20150-1 · Vendor Advisory