Logo
›
›vulnerability›CVE-2025-11840
Name
CVE-2025-11840
Source
NVD ( link)Debian ( link)
Description
A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.
CWEs
CWE-119 CWE-125
Published Date
Updated Date
Workaround
-
Advisories
https://sourceware.org/bugzilla/attachment.cgi?id=16351Exploit
https://sourceware.org/bugzilla/attachment.cgi?id=16357Not Applicable
https://sourceware.org/bugzilla/show_bug.cgi?id=33455Exploit
https://vuldb.com/?ctiid.328775Permissions Required
https://vuldb.com/?id.328775VDB Entry
https://vuldb.com/?submit.661281VDB Entry
https://www.gnu.org/Product

Analysis#

Affected Component
Analysis
binutils
Patched

Vulnerability Ratings#

1.9
CVSSv4
3.3
CVSSv31
5.5
CVSSv31
1.7
CVSSv2
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
binutils
buildroot
2025.02.x
2.43.1
Not Affected
binutils
buildroot
master
2.45.1
Not Affected
binutils
openwrt
master
2.46.0-r1
Not Affected
binutils
openwrt
openwrt-25.12
2.45.1-r1
Not Affected
binutils
yocto
master
2.46.1
Not Affected
binutils
yocto
scarthgap
2.42
Patched

Resolved with patches#

binutils (yocto:kirkstone)

#
Title
Author
Resolve
1
PR 33455 SEGV in vfinfo at ldmisc.c:527
Alan Modra <amodra@gmail.com>
CVE-2025-11840

binutils (yocto:scarthgap)

#
Title
Author
Resolve
1
PR 33455 SEGV in vfinfo at ldmisc.c:527
Alan Modra <amodra@gmail.com>
CVE-2025-11840