Disclosure summary
A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.
Source-reported weakness categories
CWE-119, CWE-125
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-11412
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| gnu | binutils | 2.45 |
Microsoft Security Updates (CVRF) · 2025-Oct
Open original source · Updated Oct 10, 2025
GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds
Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.
Microsoft maximum product score: 3.3
| Vendor | Product / association | Version / bounds |
|---|---|---|
| Microsoft update guide | cbl2 binutils 2.37-17 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 binutils 2.41-9 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 binutils 2.41-10 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 binutils 2.37-16 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 gdb 11.2-6 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 binutils 2.41-7 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 gdb 11.2-7 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 binutils 2.37-19 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 gdb 11.2-10 on CBL Mariner 2.0 | (MSRC status code 3) |
Vendor remediation references
- CBL-Mariner Releases · build 2.37-18 · product IDs 20525-17086
- Vendor guidance · product IDs 20525-17086
- CBL-Mariner Releases · build 2.41-10 · product IDs 20568-17084, 20618-17084
- Vendor guidance · product IDs 20568-17084, 20618-17084
- CBL-Mariner Releases · build 11.2-10 · product IDs 20524-17086, 20598-17086
- Vendor guidance · product IDs 20524-17086, 20598-17086
- CBL-Mariner Releases · build 2.37-19 · product IDs 20599-17086
- Vendor guidance · product IDs 20599-17086
Original records & references
- NIST NVD record
- CVE Program record
- sourceware.org — Broken Link
- sourceware.org — Exploit, Issue Tracking
- sourceware.org — Exploit, Issue Tracking
- sourceware.org — Patch
- vuldb.com — Permissions Required, VDB Entry
- vuldb.com — Third Party Advisory, VDB Entry
- www.gnu.org — Third Party Advisory, VDB Entry
- cert-portal.siemens.com
- sourceware.org — Exploit, Issue Tracking
PUBLISHED 2025-10-07T18:15:34-04:00
MODIFIED 2026-10-08T09:10:00-04:00
INGESTED 2026-10-08T12:30:36-04:00