PT-2025-41306 · Gnu+4 · Gnu Binutils+4

Yifan Zhang · Published 2025-09-30 · Updated 2026-04-20 · CVE-2025-11495

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.45

Description A heap-based buffer overflow exists in the Linker component of GNU Binutils. The issue is located in the elf x86 64 relocate section function within the elf64-x86-64.c file. This manipulation can be exploited locally. The exploit has been publicly disclosed.

Recommendations Deploy patch 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

BDU:2025-16062

CVE-2025-11495

ECHO-E055-A186-4CE3

OPENSUSE-SU-2025:15651-1

OPENSUSE-SU-2025:20150-1

RHSA-2026:7098

SUSE-SU-2025:21195-1

SUSE-SU-2025:21197-1

SUSE-SU-2025:4096-1

USN-7919-1

Affected Products

Debian

Gnu Binutils

Linuxmint

Suse

Ubuntu

References · 100

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33502 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=33502#c3 · Exploit
• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=16393 · Exploit
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4096-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11495 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11083 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-11495 · Vendor Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 · Patch
• https://bdu.fstec.ru/vul/2025-16062 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11495 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20150-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11495 · Security Note
• https://ubuntu.com/security/CVE-2025-11413 · Vendor Advisory