CVE-2025-11412

Katalog CVE

CVSS 5.5 · Medium EPSS 0,20%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada gnu binutils. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.

Rincian

Terbit di NVD

7 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc patch
• https://vuldb.com/?id.327348 advisory pihak ketiga · vdb entry
• https://www.gnu.org/ advisory pihak ketiga · vdb entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=33452 exploit · issue tracking
• https://sourceware.org/bugzilla/show_bug.cgi?id=33452#c8 exploit · issue tracking
• https://sourceware.org/bugzilla/attachment.cgi?id=16378 broken link
• https://vuldb.com/?ctiid.327348 permissions required · vdb entry
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html