low 3.3

CVE-2025-11494 json

GNU Binutils Linker elfxx-x86.c _bfd_x86_elf_late_size_sections out-of-bounds

published 2025-10-08 13 mo ago modified 2026-10-15 25 d ago also EUVD-2025-33284

cvss: 3.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.

Patch / fix

distros 5 links 1

debian ubuntu red hat suse opensuse

binutils Debian 14 2.46-1

debian advisories DEBIAN-CVE-2025-11494

binutils Ubuntu 22.04 LTS 2.38-4ubuntu2.12
binutils Ubuntu 24.04 LTS 2.42-4ubuntu2.8
binutils Ubuntu 25.10 2.45-7ubuntu1.2
binutils Ubuntu Pro 18.04 LTS 2.30-21ubuntu1~18.04.9+esm13
binutils Ubuntu Pro 20.04 LTS 2.34-6ubuntu1.11+esm2

ubuntu advisories UBUNTU-CVE-2025-11494

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

binutils hummingbird 1 2.45.1-5.hum1
binutils-gold hummingbird 1 2.45.1-5.hum1
binutils-gprofng hummingbird 1 2.45.1-5.hum1

red hat advisories RHSA-2026:7098

binutils SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.45-160000.1.1
bpftool SLES for SAP applications 16.0, SLES 16.0 7.5.0-160000.2.3
binutils SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +18 more 2.45-150100.7.57.1
perf SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 6.4.0.git33229.a3afe13a7f-150600.3.17.1
perf SLE Module for Development Tools 15 SP7 6.4.0.git54263.0aad576b1c-150700.3.2.2
perf SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 5.3.18-150300.38.7.1
perf SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 5.14.21-150400.44.20.1
perf SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.52.5.1

suse advisories SUSE-SU-2025:21195-1 SUSE-SU-2025:21197-1 SUSE-SU-2025:4096-1

binutils openSUSE Leap 16.0 2.45-160000.1.1
bpftool openSUSE Leap 16.0 7.5.0-160000.2.3
cross-rx-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-arm-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-avr-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-bpf-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-ppc-binutils openSUSE Leap 16.0 2.45-160000.1.1
cross-pru-binutils openSUSE Leap 16.0 2.45-160000.1.1

opensuse advisories openSUSE-SU-2025:20150-1 openSUSE-SU-2025:15651-1

sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642… patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11494 updated 2026-11-07 cvss 3.3

binutils: GNU Binutils Linker out-of-bounds read

Red Hat Enterprise Linux 6 binutils Red Hat Enterprise Linux 7 gdb, binutils, gdb-gdbserver
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 gdb, binutils, gdb-headless, gdb-gdbserver, mingw-binutils, mingw32-binutils, +9 more Red Hat Enterprise Linux 9 gdb, binutils, gdb-minimal, gdb-headless, binutils-gold, gdb-gdbserver, +13 more Red Hat Enterprise Linux 10 gdb, binutils, mingw-binutils, mingw32-binutils, mingw64-binutils, gcc-toolset-15-binutils Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9
under investigation
Red Hat Hardened Images binutils 2.45.1-5.hum1, binutils-gold 2.45.1-5.hum1, binutils-gprofng 2.45.1-5.hum1
fixed: vendor fix RHSA-2026:7098

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-162-05 updated 2026-05-14 cvss 3.3

Siemens SIMATIC S7-1500 CPU family

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 13 mo ago (2025-10-08)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

sourceware.org https://sourceware.org/bugzilla/attachment.cgi?id=16389 referenced PoC, tagged "exploit" by a source, unverified
sourceware.org https://sourceware.org/bugzilla/show_bug.cgi?id=33499 referenced PoC, tagged "exploit" by a source, unverified
sourceware.org https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	3.0	3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA	4.0	1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P

Affected products

GNU Binutils
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-125 Out-of-bounds Read
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

sourceware.org /git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a
patch
sourceware.org /bugzilla/attachment.cgi?id=16389
exploit, broken-link
sourceware.org /bugzilla/show_bug.cgi?id=33499
issue-tracking, exploit
sourceware.org /bugzilla/show_bug.cgi?id=33499#c2
issue-tracking, exploit
vuldb.com /?id.327619
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.327619
signature, permissions-required, vdb-entry
vuldb.com /?submit.668281
third-party-advisory, vdb-entry
gnu.org /
product
cert-portal.siemens.com /productcert/html/ssa-082556.html

Sources

CVE List CVE-2025-11494
NVD CVE-2025-11494

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary