A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Gnu
  • Binutils

No data.

No data.

References
Link Providers
https://nvd.nist.gov/vuln/detail/CVE-2025-11083 cve-icon
https://sourceware.org/bugzilla/attachment.cgi?id=16353 cve-icon cve-icon cve-icon
https://sourceware.org/bugzilla/show_bug.cgi?id=33457 cve-icon cve-icon cve-icon cve-icon
https://sourceware.org/bugzilla/show_bug.cgi?id=33457#c1 cve-icon cve-icon cve-icon cve-icon
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490 cve-icon cve-icon cve-icon
https://vuldb.com/?ctiid.326124 cve-icon cve-icon cve-icon
https://vuldb.com/?id.326124 cve-icon cve-icon cve-icon
https://vuldb.com/?submit.661277 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-11083 cve-icon
https://www.gnu.org/ cve-icon cve-icon cve-icon
History

Tue, 30 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 29 Sep 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Sep 2025 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu binutils
Vendors & Products Gnu
Gnu binutils

Sat, 27 Sep 2025 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".
Title GNU Binutils Linker elfcode.h elf_swap_shdr heap-based overflow
Weaknesses CWE-119
CWE-122
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-09-29T14:55:31.920Z

Reserved: 2025-09-26T13:47:24.943Z

Link: CVE-2025-11083

cve-icon Vulnrichment

Updated: 2025-09-29T14:54:54.157Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-27T23:15:32.330

Modified: 2025-09-29T19:34:10.030

Link: CVE-2025-11083

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-27T23:02:08Z

Links: CVE-2025-11083 - Bugzilla