CVE-2025-11082 GNU Binutils Linker elf-eh-frame.c _bfd_elf_parse_eh_frame heap-based overflow

Medium 4.8 Published 27 Sep 2025 Updated 15 Oct 2026

A heap-based buffer overflow in the GNU Binutils linker allows local attackers to execute arbitrary code or cause a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-11082?

CVE-2025-11082 is a medium-severity memory corruption vulnerability in Gnu Binutils, published on 27 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

Weakness: CWE-122, CWE-119

Which versions are affected by CVE-2025-11082?

It affects 1 product.

Products include Gnu Binutils.

How do I fix CVE-2025-11082?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-11082 being exploited?

There is no known exploitation of CVE-2025-11082 in the wild and no public exploit code.

All Gnu Binutils vulnerabilities

Sources

Also known as AZL-67902, AZL-67908, AZL-67914, AZL-67922, AZL-67925, AZL-67928 and 15 more.