CVE-2025-11494

What it actually does

Out-of-bounds read in the _bfd_x86_elf_late_size_sections function of bfd/elfxx-x86.c in the linker component, resulting from manipulation of ELF section data.

Why it matters to the business

Local denial-of-service conditions that can interrupt build pipelines, compilation workflows, and linker-dependent operations on affected systems, with low but non-zero risk of broader instability.

How an attack unfolds

A local attacker supplies a crafted ELF object file to the vulnerable linker function, triggering an out-of-bounds read that has been publicly disclosed and can be reproduced without elevated privileges.

How to fix it

Apply the upstream patch b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. Upgrade openjdk-7 packages to 7u85-2.6.1-5ubuntu0.14.04.1 and openjdk-6 packages to 6b37-1.13.9-1ubuntu0.14.04.1 on Ubuntu 14.04 LTS systems.

How to confirm the fix worked

Confirm package versions match the listed fixed releases, recompile test binaries with the patched linker, and verify absence of the vulnerable function behavior under crafted inputs.

Typical attack path

1. Gain local access to a system running an affected version
2. Craft or obtain a malicious ELF input file designed to reach the vulnerable code path
3. Invoke the linker (ld) against the malicious input
4. Trigger the out-of-bounds read leading to process crash or memory disclosure

How to detect it

Search build logs and system logs for linker segmentation faults or abnormal terminations during ELF processing; correlate with file creation timestamps of suspicious object files.

What your security team should do

• Prioritize patching of build and development systems within the next maintenance window
• Restrict untrusted object files from being processed by the linker on multi-user systems
• Monitor build-farm logs for unexpected linker crashes