CVE-2025-11413: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
A vulnerability was found in GNU Binutils 2.45. Affected is the function elflinkaddobjectsymbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
Other sources
GNU Binutils Linker elflink.c elflinkaddobjectsymbols out-of-bounds
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Binutils (Linker)to a version that resolves this vulnerability.Fixed in 2.46Patch 72efdf166aa0ed72ecc69fc2349af6591a7a19c0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11413?
CVE-2025-11413 has a high severity due to its potential for causing out-of-bounds read vulnerabilities.
How do I fix CVE-2025-11413?
To fix CVE-2025-11413, you should update GNU Binutils to the latest version, as the vulnerability exists in version 2.45.
What component is affected by CVE-2025-11413?
CVE-2025-11413 affects the linker component, specifically the function elf_link_add_object_symbols in bfd/elflink.c.
Can CVE-2025-11413 be exploited remotely?
No, CVE-2025-11413 requires local access to exploit, making it a local vulnerability.
What should I do if I can't upgrade GNU Binutils to mitigate CVE-2025-11413?
If you cannot upgrade, limit access to the affected systems and monitor for any suspicious activity as an interim measure.