IM
IronMonkey Threat Research

CVE-2025-11083 HIGH

Published: 2025-09-27 | Last Modified: 2026-10-09 | Status: Modified

Description

A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".

Additional Descriptions (1)

Una vulnerabilidad ha sido encontrada en GNU Binutils 2.45. El elemento afectado es la función elf_swap_shdr en la biblioteca bfd/elfcode.h del componente Linker. La manipulación conduce a desbordamiento de búfer basado en montículo. El ataque debe llevarse a cabo localmente. El exploit ha sido divulgado al público y puede ser usado. El identificador del parche es 9ca499644a21ceb3f946d1c179c38a83be084490. Para solucionar este problema, se recomienda desplegar un parche. El mantenedor del código respondió con '[f]ixed for 2.46'.

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Base Score: 4.3 (MEDIUM)

AV:L/AC:L/Au:S/C:P/I:P/A:P

Access VectorLOCAL
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Secondary

Exploitability Score: 3.1

Impact Score: 6.4

Base Score: 1.9 (LOW)

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack VectorLOCAL
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredLOW
User InteractionNONE
Vulnerability ConfidentialityLOW
Vulnerability IntegrityLOW
Vulnerability AvailabilityLOW
Subsequent ConfidentialityNONE
Subsequent IntegrityNONE
Subsequent AvailabilityNONE

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-119
en CWE-122

Affected Products

Vendor Product Version Update Type
gnu binutils 2.45 <built-in method update of dict object at 0x7fd340225d80> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnu:binutils:2.45:*:*:*:*:*:*:*

References