CVE-2025-11082

HighCVSS 7.8/10Last modified Oct 9, 2026

Description

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
GNU	Binutils	2.45
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < *
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < *
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.5, < *
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.5, < *
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < *

References

https://sourceware.org/bugzilla/attachment.cgi?id=16358Broken Link
https://sourceware.org/bugzilla/show_bug.cgi?id=33464Exploit, Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2Exploit, Issue Tracking
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8Patch
https://vuldb.com/?ctiid.326123Permissions Required, VDB Entry
https://vuldb.com/?id.326123Third Party Advisory, VDB Entry
https://vuldb.com/?submit.661276Third Party Advisory, VDB Entry
https://www.gnu.org/Product
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Timeline

Published: Sep 27, 2025
Last modified: Oct 9, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-110837.8A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the CVE-2025-110847.6A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cooki CVE-2025-110858.6A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of mali CVE-2025-110868.1The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all ver CVE-2025-110878.8The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2 CVE-2025-110888.8A weakness has been identified in itsourcecode Open Source Job Portal 1.0. Impacted is an unknown function of the file /admin/vacancy/index.CVE-2025-110899.8A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown funct CVE-2025-110908.8A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected is an unknown function of the file /admin/employee/index CVE-2025-110918.8A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /gofo CVE-2025-110928.8A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_s CVE-2025-110937.2An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Scr CVE-2025-110949.8A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_pr