Skip to content
OpenAdvisories
Medium USN-7899-1 11 CVEs

binutils vulnerabilities

Published Dec 1, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GNU binutils could be forced to perform an out-
of-bounds read in certain instances. An attacker with local access to
a system could possibly use this issue to cause a denial of service.
(CVE-2025-11839, CVE-2025-11840)

It was discovered that GNU binutils incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04
LTS, and Ubuntu 20.04 LTS. (CVE-2025-8225)

It was discovered that GNU binutils incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2025-5244, CVE-2025-5245)

It was discovered that GNU binutils incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2025-3198)

It was discovered that GNU binutils incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2025-1182)

It was discovered that ld in GNU binutils incorrectly handled certain
files. An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code. This issue
only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2025-1181)

It was discovered that GNU binutils incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash, expose
sensitive information or execute arbitrary code. This issue only
affected Ubuntu 25.04. (CVE-2025-1153)

It was discovered that GNU binutils incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. This issue only affected Ubuntu 14.04 LTS.
(CVE-2025-0840)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS binutils 2.38-4ubuntu2.11
Ubuntu · 24.04 LTS 24.04:LTS binutils 2.42-4ubuntu2.7
Ubuntu · 25.10 binutils 2.45-7ubuntu1.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS binutils 2.24-5ubuntu14.2+esm7
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS binutils 2.26.1-1ubuntu1~16.04.8+esm13
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS binutils 2.30-21ubuntu1~18.04.9+esm5
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS binutils 2.34-6ubuntu1.11+esm1

Vulnerabilities 11

  • Medium 5.3
    CVE-2025-5244

    GNU Binutils ld elflink.c elf_gc_sweep memory corruption

    A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2025-5245

    GNU Binutils objdump debug.c debug_type_samep memory corruption

    A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to appro…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2025-7545 Public exploit

    GNU Binutils objcopy.c copy_section heap-based overflow

    A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Wolfi
  • Medium 5.0
    CVE-2025-0840

    GNU Binutils objdump.c disassemble_bytes stack-based overflow

    A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible t…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Alpine
  • Medium 5.0
    CVE-2025-1181

    GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption

    A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remote…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux
  • Medium 5.0
    CVE-2025-1182

    GNU Binutils ld elflink.c bfd_elf_reloc_symbol_deleted_p memory corruption

    A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux
  • Low 3.3
    CVE-2025-11839

    GNU Binutils prdbg.c tg_tag_type return value

    A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the pu…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Wolfi
  • Low 3.3
    CVE-2025-11840

    GNU Binutils ldmisc.c vfinfo out-of-bounds

    A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the…

    GNU Binutils binutils binutils Debian Ubuntu Wolfi
  • Low 3.3
    CVE-2025-3198

    GNU Binutils objdump bucomm.c display_info memory leak

    A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2025-8225

    GNU Binutils DWARF Section dwarf.c process_debug_info memory leak

    A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Alpine
  • Low 3.1
    CVE-2025-1153

    GNU Binutils format.c bfd_set_format memory corruption

    A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity…

    GNU Binutils binutils binutils Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2025-0840
  • report
    https://ubuntu.com/security/CVE-2025-1153
  • report
    https://ubuntu.com/security/CVE-2025-1181
  • report
    https://ubuntu.com/security/CVE-2025-1182
  • report
    https://ubuntu.com/security/CVE-2025-3198
  • report
    https://ubuntu.com/security/CVE-2025-5244
  • report
    https://ubuntu.com/security/CVE-2025-5245
  • report
    https://ubuntu.com/security/CVE-2025-7545
  • report
    https://ubuntu.com/security/CVE-2025-8225
  • report
    https://ubuntu.com/security/CVE-2025-11839
  • report
    https://ubuntu.com/security/CVE-2025-11840