Red Hat Security Advisory: binutils security update

The binutils packages in Red Hat Enterprise Linux 10.0 Extended Update Support and Red Hat Hardened Images contain heap-based overflow vulnerabilities in the GNU Binutils linker, tracked as CVE-2025-11082 and CVE-2025-11083. These vulnerabilities could potentially lead to memory corruption during the linking process. Red Hat has issued security advisories RHSA-2025:23405 and RHSA-2026:39022 detailing these issues and providing updated packages to fix them. The affected products include binutils versions prior to 2.41-53.el10_0.2 for RHEL 10.0 EUS and binutils 2.46.1-1.hum1 for Hardened Images. The advisories rate the impact as moderate and provide instructions for applying the updates.

The heap-based overflow vulnerabilities in the GNU Binutils linker could allow an attacker to cause memory corruption, which may lead to crashes or potentially arbitrary code execution during the linking process. However, the Red Hat advisories rate the security impact as moderate, indicating a limited scope or complexity of exploitation. There are no known exploits in the wild reported at this time.

Red Hat has released official security updates that fix these heap-based overflow vulnerabilities in binutils. Users of Red Hat Enterprise Linux 10.0 Extended Update Support and Red Hat Hardened Images should apply the provided binutils package updates as detailed in advisories RHSA-2025:23405 and RHSA-2026:39022. Instructions for applying these updates are available at https://access.redhat.com/articles/11258 and https://images.redhat.com/. No additional mitigation steps are indicated by the vendor.