low 3.3

CVE-2025-11412 json

GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds

published 2025-10-07 13 mo ago modified 2026-10-15 25 d ago also EUVD-2025-31867

cvss: 3.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.

Patch / fix

distros 6 links 1

debian ubuntu red hat suse opensuse azure linux

binutils Debian 14 2.46-1

debian advisories DEBIAN-CVE-2025-11412

binutils Ubuntu 22.04 LTS 2.38-4ubuntu2.12
binutils Ubuntu 24.04 LTS 2.42-4ubuntu2.8
binutils Ubuntu 25.10 2.45-7ubuntu1.2
binutils Ubuntu Pro 14.04 LTS 2.24-5ubuntu14.2+esm8
binutils Ubuntu Pro 16.04 LTS 2.26.1-1ubuntu1~16.04.8+esm14
binutils Ubuntu Pro 18.04 LTS 2.30-21ubuntu1~18.04.9+esm13
binutils Ubuntu Pro 20.04 LTS 2.34-6ubuntu1.11+esm2

ubuntu advisories UBUNTU-CVE-2025-11412

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

binutils hummingbird 1 2.45.1-5.hum1
binutils-gold hummingbird 1 2.45.1-5.hum1
binutils-gprofng hummingbird 1 2.45.1-5.hum1

red hat advisories RHSA-2026:7098

binutils SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.45-160000.1.1
bpftool SLES for SAP applications 16.0, SLES 16.0 7.5.0-160000.2.3
binutils SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +18 more 2.45-150100.7.57.1
perf SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 6.4.0.git33229.a3afe13a7f-150600.3.17.1
perf SLE Module for Development Tools 15 SP7 6.4.0.git54263.0aad576b1c-150700.3.2.2
perf SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 5.3.18-150300.38.7.1
perf SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 5.14.21-150400.44.20.1
perf SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.52.5.1

suse advisories SUSE-SU-2025:21195-1 SUSE-SU-2025:21197-1 SUSE-SU-2025:4096-1

binutils openSUSE Leap 16.0 2.45-160000.1.1
bpftool openSUSE Leap 16.0 7.5.0-160000.2.3
cross-rx-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-arm-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-avr-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-bpf-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-ppc-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-pru-binutils openSUSE Leap 16.0 2.45-160000.1.1

opensuse advisories openSUSE-SU-2025:20150-1 openSUSE-SU-2025:15651-1

binutils CBL-Mariner 2.0 2.37-19
gdb CBL-Mariner 2.0 11.2-10
binutils Azure Linux 3.0 2.41-10

azure linux advisories AZL-68376 AZL-68394 AZL-68403

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c66… patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11412 updated 2026-11-07 cvss 3.3

binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds

Red Hat Enterprise Linux 6 binutils Red Hat Enterprise Linux 7 gdb, binutils, gdb-gdbserver
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 gdb, binutils, gdb-headless, gdb-gdbserver, mingw-binutils, mingw32-binutils, +9 more Red Hat Enterprise Linux 9 gdb, binutils, gdb-minimal, gdb-headless, binutils-gold, gdb-gdbserver, +13 more Red Hat Enterprise Linux 10 gdb, binutils, mingw-binutils, mingw32-binutils, mingw64-binutils, gcc-toolset-15-binutils Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9
under investigation
Red Hat Hardened Images binutils 2.45.1-5.hum1, binutils-gold 2.45.1-5.hum1, binutils-gprofng 2.45.1-5.hum1
fixed: vendor fix RHSA-2026:7098

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-162-05 updated 2026-05-14 cvss 3.3

Siemens SIMATIC S7-1500 CPU family

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 13 mo ago (2025-10-08)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

sourceware.org https://sourceware.org/bugzilla/show_bug.cgi?id=33452 referenced PoC, tagged "exploit" by a source, unverified
sourceware.org https://sourceware.org/bugzilla/attachment.cgi?id=16378 referenced PoC, tagged "exploit" by a source, unverified
sourceware.org https://sourceware.org/bugzilla/show_bug.cgi?id=33452#c8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	3.0	3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA	4.0	1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P

Affected products

GNU Binutils
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-125 Out-of-bounds Read
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

sourceware.org /git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc
patch
sourceware.org /bugzilla/show_bug.cgi?id=33452
issue-tracking, exploit
sourceware.org /bugzilla/attachment.cgi?id=16378
exploit, broken-link
sourceware.org /bugzilla/show_bug.cgi?id=33452#c8
issue-tracking, exploit
vuldb.com /?id.327348
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.327348
signature, permissions-required, vdb-entry
gnu.org /
product, third-party-advisory, vdb-entry
cert-portal.siemens.com /productcert/html/ssa-082556.html

Sources

CVE List CVE-2025-11412
NVD CVE-2025-11412

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary