Multiple vulnerabilities in GNU Binutils



| Updated: 2025-04-08
Risk High
Patch available YES
Number of vulnerabilities 14
CVE-ID CVE-2025-0840
CVE-2024-57360
CVE-2025-1176
CVE-2025-1182
CVE-2025-1181
CVE-2025-1178
CVE-2025-1147
CVE-2025-1179
CVE-2025-1180
CVE-2025-1152
CVE-2025-1150
CVE-2025-1151
CVE-2025-1149
CVE-2025-1148
CWE-ID CWE-121
CWE-119
CWE-122
CWE-401
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Binutils
Universal components / Libraries / Libraries used by multiple products

Vendor GNU

Security Bulletin

This security bulletin contains information about 14 vulnerabilities.

1) Stack-based buffer overflow

EUVDB-ID: #VU103887

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0840

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the disassemble_bytes() function in binutils/objdump.c within the nm binary. A remote attacker can pass specially crafted input to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15882
https://sourceware.org/bugzilla/show_bug.cgi?id=32560
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893
https://vuldb.com/?ctiid.293997
https://vuldb.com/?id.293997
https://vuldb.com/?submit.485255
https://www.gnu.org/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU103886

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-57360

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling files within the nm binary. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/show_bug.cgi?id=32467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU103995

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1176

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the _bfd_elf_gc_mark_rsec() function in bfd/elflink.c within the ld binary. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15913
https://sourceware.org/bugzilla/show_bug.cgi?id=32636
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814
https://vuldb.com/?ctiid.295079
https://vuldb.com/?id.295079
https://vuldb.com/?submit.495329


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU103994

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1182

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the bfd_elf_reloc_symbol_deleted_p() function in bfd/elflink.c within the ld binary. A remote attacker can pass specially crafted input to the binary, trigger memory corruption and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15919
https://sourceware.org/bugzilla/show_bug.cgi?id=32644
https://sourceware.org/bugzilla/show_bug.cgi?id=32644
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b425859021d17adf62f06fb904797cf8642986ad
https://vuldb.com/?ctiid.295086
https://vuldb.com/?id.295086
https://vuldb.com/?submit.495407
https://vuldb.com/?submit.495407


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU103993

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1181

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the _bfd_elf_gc_mark_rsec() function in bfd/elflink.c within the ld binary. A remote attacker can pass specially crafted input to the binary, trigger memory corruption and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: before 2.44

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15918
https://sourceware.org/bugzilla/show_bug.cgi?id=32643
https://sourceware.org/bugzilla/show_bug.cgi?id=32643
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24
https://vuldb.com/?ctiid.295084
https://vuldb.com/?id.295084
https://vuldb.com/?submit.495402
https://vuldb.com/?submit.495402


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU104149

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1178

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the bfd_putl64() function in libbfd.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15914
https://sourceware.org/bugzilla/show_bug.cgi?id=32638
https://sourceware.org/bugzilla/show_bug.cgi?id=32638
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0
https://vuldb.com/?ctiid.295081
https://vuldb.com/?id.295081
https://vuldb.com/?submit.495369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU104152

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1147

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the __sanitizer::internal_strlen() function in binutils/nm.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15881
https://sourceware.org/bugzilla/show_bug.cgi?id=32556
https://vuldb.com/?ctiid.295051
https://vuldb.com/?id.295051
https://vuldb.com/?submit.485254


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU104151

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1179

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the bfd_putl64() function in bfd/libbfd.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15915
https://sourceware.org/bugzilla/show_bug.cgi?id=32640
https://sourceware.org/bugzilla/show_bug.cgi?id=32640#c1
https://vuldb.com/?ctiid.295082
https://vuldb.com/?id.295082
https://vuldb.com/?submit.495376


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU104150

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1180

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the _bfd_elf_write_section_eh_frame() function in bfd/elf-eh-frame.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.7 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15917
https://sourceware.org/bugzilla/show_bug.cgi?id=32642
https://sourceware.org/bugzilla/show_bug.cgi?id=32642
https://vuldb.com/?ctiid.295083
https://vuldb.com/?id.295083
https://vuldb.com/?submit.495381
https://vuldb.com/?submit.495381


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Memory leak

EUVDB-ID: #VU107137

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1152

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the xstrdup() function in xstrdup.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.43 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15887
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
https://vuldb.com/?ctiid.295056


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU107138

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1150

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the bfd_malloc() function in libbfd.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.43 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15887
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
https://vuldb.com/?ctiid.295054


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Memory leak

EUVDB-ID: #VU107139

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1151

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the xmemdup() function in xmemdup.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.43 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15887
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
https://vuldb.com/?ctiid.295055


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Memory leak

EUVDB-ID: #VU107140

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1149

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the xstrdup() function in libiberty/xmalloc.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.43 - 2.43.1

CPE2.3 External links

https://sourceware.org/bugzilla/attachment.cgi?id=15887
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
https://vuldb.com/?ctiid.295053


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Memory leak

EUVDB-ID: #VU107141

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1148

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the link_order_scan() function in ld/ldelfgen.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Binutils: 2.43 - 2.43.1

CPE2.3 External links

https://security.netapp.com/advisory/ntap-20250404-0004/
https://sourceware.org/bugzilla/attachment.cgi?id=15887
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
https://vuldb.com/?ctiid.295052


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###