CVE-2025-11840mediumCWE-119CWE-125

CVE-2025-11840: medium-severity vulnerability in GNU Binutils

GNU Binutils ldmisc.c vfinfo out-of-bounds

Published · Updated

Follow this CVE+ Monitor Binutils+ Monitor binutils

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.3%
A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
GNU · Binutils
Related CVEs — GNU Binutils

In the same product, most dangerous first.

CVE-2025-1153LOWGNU Binutils format.c bfd_set_format memory corruptionEPSS 1.4%CVE-2025-1178MEDIUMGNU Binutils ld libbfd.c bfd_putl64 memory corruptionEPSS 0.8%CVE-2025-0840MEDIUMGNU Binutils objdump.c disassemble_bytes stack-based overflowEPSS 0.8%CVE-2025-1181LOWGNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruptionEPSS 0.7%CVE-2025-1180LOWGNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruptionEPSS 0.7%CVE-2025-1176LOWGNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflowEPSS 0.7%