CVE-2025-11494: GNU Binutils Linker elfxx-x86.c _bfd_x86_elf_late_size_sections out-of-bounds
A vulnerability was found in GNU Binutils 2.45. Impacted is the function bfdx86elflatesizesections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.
Other sources
GNU Binutils Linker elfxx-x86.c bfdx86elflatesizesections out-of-bounds
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Binutilsto a version that resolves this vulnerability.Fixed in 2.45Patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a - Compensating control
Approach the vulnerability locally (limit exposure so the locally-triggerable out-of-bounds read in _bfd_x86_elf_late_size_sections cannot be reached remotely).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11494?
CVE-2025-11494 is considered a high severity vulnerability due to its potential for causing out-of-bounds read attacks.
How do I fix CVE-2025-11494?
To fix CVE-2025-11494, it is recommended to update GNU Binutils to the latest version where the issue has been patched.
What component is impacted by CVE-2025-11494?
CVE-2025-11494 impacts the Linker component specifically within the _bfd_x86_elf_late_size_sections function.
Can CVE-2025-11494 be exploited remotely?
CVE-2025-11494 requires local access to exploit, making it less of a risk compared to remote vulnerabilities.
What kind of attack does CVE-2025-11494 facilitate?
CVE-2025-11494 facilitates an out-of-bounds read attack, which can lead to information disclosure or application crashes.