Buffer overflow in Binutils - CVE-2025-11840

Vulnerability identifier: #VU117838

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11840

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a boundary error within the vfinfo() function in ldmisc.c. A local user can trigger memory corruption and perform a denial of service attack.

Binutils
Ubuntu
openEuler
binutils (Ubuntu package)
gdb-help
gdb
gdb-debuginfo
gdb-debugsource
gdb-gdbserver
gdb-headless

Install updates from vendor's repository.

binutils (Ubuntu package) - addressed in versions 2.24-5ubuntu14.2+esm7, 2.26.1-1ubuntu1~16.04.8+esm13, 2.30-21ubuntu1~18.04.9+esm5, 2.34-6ubuntu1.11+esm1, 2.38-4ubuntu2.11, 2.42-4ubuntu2.7, 2.44-3ubuntu1.2, 2.45-7ubuntu1.1
gdb-help - addressed in versions 9.2-15, 11.1-16, 14.1-11
gdb - addressed in versions 9.2-15, 11.1-16, 14.1-11
gdb-debuginfo - addressed in versions 9.2-15, 11.1-16, 14.1-11
gdb-debugsource - addressed in versions 9.2-15, 11.1-16, 14.1-11
gdb-gdbserver - addressed in versions 9.2-15, 11.1-16, 14.1-11
gdb-headless - addressed in versions 9.2-15, 11.1-16, 14.1-11

• https://sourceware.org/bugzilla/attachment.cgi?id=16351
• https://sourceware.org/bugzilla/attachment.cgi?id=16357
• https://sourceware.org/bugzilla/show_bug.cgi?id=33455
• https://vuldb.com/?ctiid.328775
• https://vuldb.com/?id.328775
• https://vuldb.com/?submit.661281

• Two local DoS vulnerabilities in GNU Binutils
• openEuler 24.03 LTS SP1 update for gdb
• openEuler 24.03 LTS update for gdb
• openEuler 22.03 LTS SP4 update for gdb
• openEuler 22.03 LTS SP3 update for gdb
• openEuler 20.03 LTS SP4 update for gdb
• openEuler 24.03 LTS SP2 update for gdb
• Ubuntu update for binutils