CVE-2025-11413: Out-of-Bounds Read in GNU Binutils
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
AI Analysis
Technical Summary
The vulnerability CVE-2025-11413 affects GNU Binutils 2.45 in the elf_link_add_object_symbols function of the bfd/elflink.c source file. It causes an out-of-bounds read due to improper handling of object symbols during linking. The attack vector is local with low complexity and privileges required. The vulnerability has a CVSS 4.8 (medium) score and has a public exploit available. The issue is fixed in GNU Binutils version 2.46 with patch identified by commit 72efdf166aa0ed72ecc69fc2349af6591a7a19c0.
Potential Impact
An attacker with local access can trigger an out-of-bounds read in the linker component, potentially leading to information disclosure or application instability. The vulnerability does not require user interaction and has a medium severity rating. No remote exploitation or privilege escalation is indicated.
Mitigation Recommendations
Upgrade GNU Binutils to version 2.46 or later to apply the official patch (commit 72efdf166aa0ed72ecc69fc2349af6591a7a19c0) that fixes this out-of-bounds read vulnerability. This is the recommended and effective remediation.
CVE-2025-11413: Out-of-Bounds Read in GNU Binutils
Description
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
CVSS v4.0
Score 4.8medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-11413 affects GNU Binutils 2.45 in the elf_link_add_object_symbols function of the bfd/elflink.c source file. It causes an out-of-bounds read due to improper handling of object symbols during linking. The attack vector is local with low complexity and privileges required. The vulnerability has a CVSS 4.8 (medium) score and has a public exploit available. The issue is fixed in GNU Binutils version 2.46 with patch identified by commit 72efdf166aa0ed72ecc69fc2349af6591a7a19c0.
Potential Impact
An attacker with local access can trigger an out-of-bounds read in the linker component, potentially leading to information disclosure or application instability. The vulnerability does not require user interaction and has a medium severity rating. No remote exploitation or privilege escalation is indicated.
Mitigation Recommendations
Upgrade GNU Binutils to version 2.46 or later to apply the official patch (commit 72efdf166aa0ed72ecc69fc2349af6591a7a19c0) that fixes this out-of-bounds read vulnerability. This is the recommended and effective remediation.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulDB
- Date Reserved
- 2025-10-07T10:40:46.002Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68e590fca677756fc9a3f98b
Added to database: 10/07/2025, 22:15:24 UTC
Last enriched: 07/15/2026, 11:14:31 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 284
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.