CVE-2025-11840: GNU Binutils ldmisc.c vfinfo out-of-bounds
A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.
Other sources
GNU Binutils ldmisc.c vfinfo out-of-bounds
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 16357 - Compensating control
Since the attack can only be executed locally, limit local access to affected systems (e.g., restrict who can run GNU Binutils and administrative/local shell access).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11840?
CVE-2025-11840 has been classified with a medium severity due to the potential for local exploitation leading to out-of-bounds read.
How do I fix CVE-2025-11840?
To mitigate CVE-2025-11840, upgrade to a patched version of GNU Binutils that addresses this vulnerability.
Who is affected by CVE-2025-11840?
The weakness in CVE-2025-11840 affects users of GNU Binutils version 2.45.
Can CVE-2025-11840 be exploited remotely?
No, CVE-2025-11840 can only be exploited through local access.
What does the out-of-bounds read in CVE-2025-11840 lead to?
The out-of-bounds read in CVE-2025-11840 can potentially disclose sensitive information to an attacker.