Description
A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | Binutils | 2.45 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | binutils | 2.46-1 | — |
| Debian 13 | binutils | No fix yet | — |
| Debian 12 | binutils | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | binutils | 2.45-7ubuntu1.2 | — |
| Ubuntu 24.04 LTS | binutils | 2.42-4ubuntu2.6 | USN-7847-1 |
| Ubuntu 22.04 LTS | binutils | 2.38-4ubuntu2.10 | USN-7847-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | binutils | 2.34-6ubuntu1.11+esm2 | — |
| Ubuntu Pro 18.04 LTS | binutils | 2.30-21ubuntu1~18.04.9+esm13 | — |
| Ubuntu Pro 16.04 LTS | binutils | 2.26.1-1ubuntu1~16.04.8+esm14 | — |
| Ubuntu Pro 14.04 LTS | binutils | 2.24-5ubuntu14.2+esm8 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | binutils +2 | 2.41-58.el10_1.2 | RHSA-2025:23306 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | binutils +2 | 2.41-53.el10_0.2 | RHSA-2025:23405 |
| Red Hat Hardened Images 1 | binutils +3 | 2.45.1-5.hum1 | RHSA-2026:39022, RHSA-2026:7098 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | binutils +2 | 2.41-58.el10_1.2.alma.1 | ALSA-2025:23306 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | binutils | 2.41-58.el10_1.2 | RLSA-2025:23306 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | binutils | 2.47-1.1 | openSUSE-SU-2026:11932-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | binutils | 2.41-9 | — |
| Azure Linux 3 | crash | 8.0.4-5 | — |
| Azure Linux 3 | gdb | 13.2-6 | — |
| Azure Linux 2 (CBL-Mariner) | binutils | 2.37-19 | — |
| Azure Linux 2 (CBL-Mariner) | crash | 8.0.1-5 | — |
| Azure Linux 2 (CBL-Mariner) | gdb | 11.2-10 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | binutils +3 | 2.41-58.0.1.el10_1.2 | ELSA-2025-23306 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | binutils +2 | 2.45.1-r0 | — |
| Wolfi rolling | binutils-dev | 2.45.1-r1 | — |
Advisories 12
- ALSA-2025:23306 Moderate: binutils security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:7098 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:39022 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:23405 Red Hat Security Advisory: binutils security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:23306 Red Hat Security Advisory: binutils security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2025-2144 binutils: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 5, 2026
- openSUSE-SU-2026:11932-1 binutils-2.47-1.1 on GA media SUSE / openSUSE Security Updates · Oct 1, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- USN-7847-1 binutils vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- RLSA-2025:23306 Moderate: binutils security update Rocky Linux Security Advisories · Dec 20, 2025
- ELSA-2025-23306 Moderate: binutils security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 19, 2025
References
- VDB-326123 | GNU Binutils Linker elf-eh-frame.c _bfd_elf_parse_eh_frame heap-based overflow vdb-entry technical-description
- VDB-326123 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #661276 | GNU Binutils 2.45 Heap-based Buffer Overflow third-party-advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=33464 issue-tracking
- https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2 issue-tracking
- https://sourceware.org/bugzilla/attachment.cgi?id=16358 exploit
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8 patch
- https://www.gnu.org/ product