CVE-2025-11495

What it actually does

Local heap-based buffer overflow in the elf_x86_64_relocate_section function within the GNU Binutils linker (elf64-x86-64.c) allows an attacker-supplied object file to corrupt adjacent heap memory during relocation processing.

Why it matters to the business

Developers or build systems that process untrusted object files with the vulnerable linker can experience crashes or memory corruption during linking, potentially disrupting software builds and requiring urgent patching of widely used toolchain components.

How an attack unfolds

An attacker crafts a malicious ELF object file containing oversized or malformed relocation entries. When a local user or automated build process invokes the linker on this file, the vulnerable relocation routine overflows a heap buffer, leading to denial of service or limited memory corruption.

How to fix it

Apply the upstream patch commit 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 or upgrade to a Binutils release containing the fix. Rebuild any custom toolchains or distributions that embed the vulnerable linker.

How to confirm the fix worked

Confirm the installed Binutils version is newer than 2.45 or contains commit 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0; test linking of known-good and edge-case object files to verify absence of crashes.

Typical attack path

1. Attacker prepares a crafted ELF object file with malicious relocation data
2. Victim invokes ld (or equivalent) on the malicious object during a local build or linking step
3. elf_x86_64_relocate_section processes the file and overflows the heap buffer
4. Process crashes or memory is corrupted, achieving denial of service

How to detect it

Review build logs and linker invocation records for unexpected crashes or segmentation faults during ELF linking; monitor for repeated ld process terminations on developer or CI systems.

What your security team should do

• Prioritize patching developer workstations and CI/CD build agents that use GNU Binutils
• Scan source repositories and build scripts for direct or transitive use of vulnerable Binutils versions
• Restrict local users from linking untrusted object files until patched