CVE-2025-11840: GNU Binutils ldmisc.c vfinfo out-of-bounds

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-16 · updated 2026-10-09
Weakness: CWE-119

Description

A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.

Affected products

GNU Binutils: 2.45

References

https://sourceware.org/bugzilla/attachment.cgi?id=16351
https://sourceware.org/bugzilla/attachment.cgi?id=16357
https://sourceware.org/bugzilla/show_bug.cgi?id=33455
https://vuldb.com/?ctiid.328775
https://vuldb.com/?id.328775
https://vuldb.com/?submit.661281
https://www.gnu.org/
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Get alerted when CVE-2025-11840 or the next vulnerability affects your stack