Junglewise Threat Intelligence

CVE-2025-11413: GNU Binutils out-of-bounds read in Linker elf_link_add_object_symbols

CVE-2025-11413 · Severity: low · CVSS 3.3 · Published 2025-10-07

Technologies: Gnu Binutils. Vendors: Gnu.

Executive brief

A vulnerability was identified in GNU Binutils, a collection of binary tools used for software development and compilation. An attacker with local access to a system could provide a specially crafted file to the linker component, causing the application to crash or behave unexpectedly. This issue primarily impacts the reliability and availability of development environments using the affected version.

Technical details

An out-of-bounds read vulnerability exists in GNU Binutils 2.45 within the elf_link_add_object_symbols function in bfd/elflink.c. The issue is triggered when the linker processes a malformed ELF object containing an empty global symbol name (""). This can lead to a heap-buffer-overflow or segmentation fault during symbol merging or output. An attacker must have local access to provide a malicious object file to the linker (ld). The vulnerability has been addressed in version 2.46 by implementing a check to reject empty global symbol names, with the fix identified in commit 72efdf166aa0ed72ecc69fc2349af6591a7a19c0.

Affected products

  • GNU Binutils 2.45

Timeline

  • 2025-09-18: other: Initial bug report submitted to Sourceware Bugzilla
  • 2025-09-25: patched: Fix committed to master branch
  • 2025-10-07: disclosed: Vulnerability published and CVE assigned

References

Related threats