CVE-2025-11413

What it actually does

Out-of-bounds read in the elf_link_add_object_symbols function within bfd/elflink.c during ELF object processing by the linker, allowing local memory access beyond allocated bounds.

Why it matters to the business

Disrupts software build and linking processes on affected systems, potentially causing crashes or limited information exposure during development and packaging workflows; low exploitability reduces immediate widespread operational risk.

How an attack unfolds

An attacker with local access supplies a crafted ELF object file that triggers the vulnerable linker function when processed, resulting in an out-of-bounds read; the public exploit demonstrates this local attack vector without requiring elevated privileges.

How to fix it

Upgrade GNU Binutils to version 2.46 or apply the patch identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0; verify the installed version and rebuild affected packages with the fixed linker.

How to confirm the fix worked

Confirm Binutils version 2.46 or later is installed via standard package managers; test linking operations with known edge-case ELF files to ensure no crashes occur; review build logs for absence of segmentation faults.

Typical attack path

1. Obtain or craft a malicious ELF object file designed to trigger the vulnerable code path
2. Invoke the linker (ld) locally against the crafted object during build or linking operations
3. Trigger the out-of-bounds read in elf_link_add_object_symbols

How to detect it

Review system and application logs for linker crashes or segmentation faults during ELF processing; inspect build artifacts and core dumps for signs of abnormal memory access patterns around object symbol handling.

What your security team should do

• Prioritize upgrade of Binutils to 2.46 across all build environments and CI/CD pipelines
• Scan for and replace any statically linked or embedded copies of the vulnerable linker
• Monitor build systems for unexpected crashes during linking tasks
• Restrict local access to build hosts where untrusted object files may be processed