CVE-2025-11414 PUBLISHED

GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds

Assigner: VulDB
Reserved: 07.10.2025 Published: 07.10.2025 Updated: 07.10.2025

A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 4.8

Product Status

Vendor GNU
Product Binutils
Versions
  • Version 2.45 is affected
  • Version 2.46 is unaffected

Credits

  • Yifan Zhang (VulDB User) reporter

References

Problem Types

  • Out-of-Bounds Read CWE
  • Memory Corruption CWE