TI-2025-10531 Aliases CVE-2025-11495 GHSA-q93h-5j3x-2h4v

GNU Binutils Linker elf64-x86-64.c elf_x86_64_relocate_section heap-based overflow

MEDIUM 55CWE-119Published 2025-10-08 · Updated 2026-10-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 1 fixed, 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00242 15th percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD and the CNA

Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GNU	Binutils	2.45	—	No fix listed	CNA

Binutils VendorGNU Affected 2.45 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gnu:binutils:2.45:::::::*	2.45	Vulnerable	GNU

cpe:2.3:a:gnu:binutils:2.45:*:*:*:*:*:*:* Versions 2.45 Vulnerable ·GNU

Remediation

Red Hat 1 advisory

RHSA-2026:7098 Released 2026-04-08 · Red Hat rating Moderate
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images binutils-2.45.1-5.hum1@aarch64, binutils-2.45.1-5.hum1@src, binutils-2.45.1-5.hum1@x86_64 +6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	—
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:7098

Timeline

2026-10-02 Threatist record created from CVE-2025-11495
2026-10-03 Alias added: GHSA-q93h-5j3x-2h4v
2026-11-06 Affected versions changed · Red Hat

References

Exploit 3

Patch 1

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0

Other 1

https://www.gnu.org/

TI-2020-13695 An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data… CVSS 3.1HIGH 8.8
TI-2025-42907 GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a… CVSS 3.1HIGH 7.5
TI-2025-41071 An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils… CVSS 3.1HIGH 7.5
TI-2025-41069 An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils… CVSS 3.1HIGH 7.5
TI-2025-41068 A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils… CVSS 3.1HIGH 7.5
TI-2021-21105 Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. CVSS 3.1HIGH 7.5

See all 287 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences