CVE-2025-11081

What it actually does

Out-of-bounds read in dump_dwarf_section of binutils/objdump.c triggered by malformed DWARF data in an ELF file, resulting in limited availability impact when run locally.

Why it matters to the business

Developers and build systems using affected Binutils versions face potential crashes during debugging or binary inspection; the listed oauth2-proxy package requires upgrade to 7.1.0, with low EPSS and no KEV indicating limited operational urgency despite public exploit availability after 396 days.

How an attack unfolds

A local attacker prepares an ELF binary containing manipulated DWARF sections, invokes objdump on the file to trigger the out-of-bounds read, and leverages the now-public exploit for denial-of-service; no named threat actors are associated.

How to fix it

Apply the patch referenced as f87a66db645caf8cc0e6fc87b0c28c78a38af59b or upgrade GNU Binutils; for the affected github.com/oauth2-proxy/oauth2-proxy/v7 package, update to version 7.1.0.

How to confirm the fix worked

Rebuild and test objdump against known-good and malformed test cases; verify oauth2-proxy version 7.1.0 or later is deployed and confirm absence of the vulnerable function path.

Typical attack path

1. Gain local system access
2. Craft ELF file with malformed DWARF data targeting dump_dwarf_section
3. Execute objdump against the malicious file
4. Observe crash or memory access behavior

How to detect it

Review system logs and process execution records for repeated objdump invocations on untrusted binaries; inspect for segmentation faults or memory errors during DWARF parsing; no specific threat actor campaigns noted.

What your security team should do

• Prioritize patching oauth2-proxy to 7.1.0 where present
• Scan development environments for vulnerable Binutils 2.45 installations
• Monitor for objdump crashes in CI/CD pipelines
• Apply vendor updates as they become available given public exploit status