CVE-2025-7546

What it actually does

Out-of-bounds write in bfd_elf_set_group_contents within bfd/elf.c allows local memory corruption when processing crafted ELF inputs.

Why it matters to the business

Local memory corruption in build and binary analysis tools can lead to crashes, corrupted outputs, or limited local code execution on developer and CI systems, slowing software delivery pipelines.

How an attack unfolds

An attacker with local access supplies a malicious ELF object to any tool linked against the vulnerable Binutils library; the bfd_elf_set_group_contents function performs an unchecked write that corrupts adjacent memory, enabling limited local impact.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to version 6.6.58-r0 or later; rebuild any dependent packages that statically link Binutils.

How to confirm the fix worked

Confirm the installed binutils package reports version 2.45 patched with commit 41461010eb7c79fee7a9d5f6209accdaac66cc6b or later; run regression tests with sample ELF inputs.

Typical attack path

1. Obtain local shell access on a system using GNU Binutils 2.45
2. Craft or obtain an ELF file that triggers bfd_elf_set_group_contents
3. Invoke a Binutils utility (objdump, ld, etc.) against the file
4. Trigger the out-of-bounds write to corrupt process memory

How to detect it

Review local process execution logs and core dumps for crashes involving objdump, ld, or other binutils utilities when processing unexpected ELF files.

What your security team should do

• Apply the fixed linux-lts package immediately on all affected systems
• Scan build and CI images for the vulnerable Binutils version
• Restrict local execution of untrusted ELF files on developer workstations