CVE-2025-1176

GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow

Published Feb 11, 2025 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Description
A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-2050 A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.
Ubuntu USN Ubuntu USN USN-7423-1 GNU binutils vulnerabilities
Ubuntu USN Ubuntu USN USN-7423-2 GNU binutils vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00093}

epss

{'score': 0.00104}

Type Values Removed Values Added
First Time appeared Gnu
Gnu binutils
CPEs cpe:2.3:a:gnu:binutils:2.43:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu binutils
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.
Title GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow
Weaknesses CWE-119
CWE-122
References
Metrics cvssV2_0

{'score': 5.1, 'vector': 'AV:N/AC:H/Au:N/C:P/I:P/A:P'}

cvssV3_0

{'score': 5, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 11, 2025, 10:03 PM
Reserved
Feb 10, 2025, 10:18 AM
Status
Modified
Published
Feb 11, 2025, 6:15 AM
Modified
Jun 17, 2026, 8:38 AM
Severity
Moderate
Public date
Feb 11, 2025, 5:31 AM