CVE-2025-11082
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-27

Last updated on: 2026-04-29

Assigner: VulDB

Description
A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-27
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-09-28
EPSS Evaluated
2026-06-14
NVD
CVE-2025-11082
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gnu binutils 2.45
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in GNU Binutils version 2.45, specifically in the _bfd_elf_parse_eh_frame function of the linker component. It allows a local attacker to cause a heap-based buffer overflow by manipulating the execution. This can lead to potential corruption of memory and unexpected behavior. The issue has been fixed in version 2.46.

Impact Analysis

The vulnerability can lead to a heap-based buffer overflow when exploited locally, which may result in corruption of memory, crashes, or potentially allow an attacker to execute arbitrary code with the privileges of the affected process. Since the attack requires local access, remote exploitation is not possible.

Mitigation Strategies

Apply the patch that fixes this vulnerability, specifically the patch identified as ea1a0737c7692737a644af0486b71e4a392cbca8, or upgrade GNU Binutils to version 2.46 or later where the issue is fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart