CVE-2025-11494 GNU Binutils Linker elfxx-x86.c _bfd_x86_elf_late_size_sections out-of-bounds
A local attacker can trigger an out-of-bounds read in the GNU Binutils linker, potentially causing a crash or leaking memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11494?
CVE-2025-11494 is a medium-severity memory corruption vulnerability in Gnu Binutils, published on 8 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.
Which versions are affected by CVE-2025-11494?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2025-11494?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-11494 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11494 exists.
Other vulnerabilities in Gnu Binutils
Sources
Also known as BELL-CVE-2025-11494, DEBIAN-CVE-2025-11494, ECHO-e73f-44bf-91b5, GHSA-g3q3-pmmg-p6p8, MINI-r3vh-2754-gh3r, ROOT-OS-DEBIAN-12-CVE-2025-11494 and 1 more.