Heap-based buffer overflow in Binutils - CVE-2025-11082

Vulnerability identifier: #VU116972

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11082

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the _bfd_elf_parse_eh_frame() function in bfd/elf-eh-frame.c. A local user can trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Binutils
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
Anolis OS
Fedora
binutils (Ubuntu package)
binutils (Red Hat package)
mingw-binutils
avr-binutils
gdb-help
gdb-headless
gdb-gdbserver
gdb-debugsource
gdb-debuginfo
gdb
insight
gdb-doc

Install update from vendor's website.

binutils (Ubuntu package) - addressed in versions 2.24-5ubuntu14.2+esm8, 2.26.1-1ubuntu1~16.04.8+esm14, 2.30-21ubuntu1~18.04.9+esm13, 2.34-6ubuntu1.11+esm2, 2.38-4ubuntu2.10, 2.38-4ubuntu2.12, 2.42-4ubuntu2.6, 2.42-4ubuntu2.8, 2.44-3ubuntu1.1, 2.44-3ubuntu1.3, 2.45-7ubuntu1.2
binutils (Red Hat package) - addressed in versions 2.41-53.el10_0.2, 2.41-58.el10_1.2
mingw-binutils - addressed in versions 2.43.1-5.fc42, 2.45-2.fc43
avr-binutils - addressed in versions 2.45-4.fc42.1, 2.45-4.fc43.1
gdb-help - addressed in versions 9.2-12, 11.1-12, 14.1-8
gdb-headless - addressed in versions 9.2-12, 11.1-12, 14.1-8
gdb-gdbserver - addressed in versions 9.2-12, 11.1-12, 14.1-8
gdb-debugsource - addressed in versions 9.2-12, 11.1-12, 14.1-8
gdb-debuginfo - addressed in versions 9.2-12, 11.1-12, 14.1-8
gdb - addressed in versions 9.2-12, 11.1-12, 14.1-8
insight - addressed in versions 13.0.50.20220502-27.fc41, 13.0.50.20220502-27.fc42, 13.0.50.20220502-27.fc43
gdb-doc - update to 14.2-3
gdb-headless - update to 14.2-3
gdb-gdbserver - update to 14.2-3
gdb - update to 14.2-3

• https://sourceware.org/bugzilla/attachment.cgi?id=16358
• https://sourceware.org/bugzilla/show_bug.cgi?id=33464
• https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8
• https://vuldb.com/?ctiid.326123
• https://vuldb.com/?id.326123
• https://vuldb.com/?submit.661276

• Privilege escalation in GNU Binutils
• Fedora 43 update for insight
• Fedora 41 update for insight
• Fedora 42 update for insight
• Fedora 42 update for mingw-binutils
• Fedora 43 update for mingw-binutils
• openEuler 24.03 LTS SP2 update for gdb
• openEuler 24.03 LTS SP1 update for gdb
• openEuler 24.03 LTS update for gdb
• openEuler 22.03 LTS SP4 update for gdb
• openEuler 22.03 LTS SP3 update for gdb
• openEuler 20.03 LTS SP4 update for gdb
• Anolis OS update for gdb
• Ubuntu update for binutils
• Ubuntu update for binutils
• Red Hat Enterprise Linux 10 update for binutils
• Red Hat Enterprise Linux 10 update for binutils
• Fedora 42 update for avr-binutils
• Fedora 43 update for avr-binutils