Description
A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | Binutils | 2.43 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | binutils | 2.45-3 | — |
| Debian 13 | binutils | No fix yet | — |
| Debian 12 | binutils | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | binutils | 2.42-4ubuntu2.5 | USN-7423-1 |
| Ubuntu 22.04 LTS | binutils | 2.38-4ubuntu2.8 | USN-7423-1 |
| Ubuntu 20.04 LTS | binutils | 2.34-6ubuntu1.11 | USN-7423-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | binutils | 2.30-21ubuntu1~18.04.9+esm4 | USN-7423-2 |
| Ubuntu Pro 16.04 LTS | binutils | 2.26.1-1ubuntu1~16.04.8+esm11 | USN-7423-2 |
| Ubuntu Pro 14.04 LTS | binutils | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP7 | openucx | 1.17.0-150700.4.2.7 | SUSE-SU-2025:4096-1 |
| SLES 15 SP7 | perf | 6.4.0.git54263.0aad576b1c-150700.3.2.2 | SUSE-SU-2025:4096-1 |
| SLES 15 SP6 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP6 | openucx | 1.15.0-150600.3.5.2 | SUSE-SU-2025:4096-1 |
| SLES 15 SP6 | perf | 6.4.0.git33229.a3afe13a7f-150600.3.17.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP5 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP5 | openucx | 1.13.1-150500.4.2.5 | SUSE-SU-2025:4096-1 |
| SLES 15 SP5 | perf | 5.14.21-150500.52.5.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP4 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP4 | openucx | 1.11.1-150400.4.2.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP4 | perf | 5.14.21-150400.44.20.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP3 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES 15 SP3 | openucx | 1.9.0-150300.4.2.5 | SUSE-SU-2025:4096-1 |
| SLES 15 SP3 | perf | 5.3.18-150300.38.7.1 | SUSE-SU-2025:4096-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | binutils | 2.45-160000.1.1 | SUSE-SU-2025:21195-1 |
| SLES for SAP 16.0 | bpftool | 7.5.0-160000.2.3 | SUSE-SU-2025:21195-1 |
| SLES for SAP 15 SP5 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP5 | openucx | 1.13.1-150500.4.2.5 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP5 | perf | 5.14.21-150500.52.5.1 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP4 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP4 | openucx | 1.11.1-150400.4.2.1 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP4 | perf | 5.14.21-150400.44.20.1 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP3 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP3 | openucx | 1.9.0-150300.4.2.5 | SUSE-SU-2025:4096-1 |
| SLES for SAP 15 SP3 | perf | 5.3.18-150300.38.7.1 | SUSE-SU-2025:4096-1 |
| SLES 16.0 | binutils | 2.45-160000.1.1 | SUSE-SU-2025:21195-1 |
| SLES 16.0 | bpftool | 7.5.0-160000.2.3 | SUSE-SU-2025:21195-1 |
| SLE Micro 6.2 | binutils | 2.45-160000.1.1 | SUSE-SU-2025:21197-1 |
| SLE HPC 15 SP5 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP5 | openucx | 1.13.1-150500.4.2.5 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP5 | perf | 5.14.21-150500.52.5.1 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP4 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP4 | openucx | 1.11.1-150400.4.2.1 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP4 | perf | 5.14.21-150400.44.20.1 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP3 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP3 | openucx | 1.9.0-150300.4.2.5 | SUSE-SU-2025:4096-1 |
| SLE HPC 15 SP3 | perf | 5.3.18-150300.38.7.1 | SUSE-SU-2025:4096-1 |
| SUSE Manager Server LTS 4.3 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SUSE Manager Server LTS 4.3 | openucx | 1.11.1-150400.4.2.1 | SUSE-SU-2025:4096-1 |
| SUSE Manager Proxy LTS 4.3 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SUSE Manager Proxy LTS 4.3 | openucx | 1.11.1-150400.4.2.1 | SUSE-SU-2025:4096-1 |
| SUSE Enterprise Storage 7.1 | binutils | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| SUSE Enterprise Storage 7.1 | openucx | 1.9.0-150300.4.2.5 | SUSE-SU-2025:4096-1 |
| SUSE Enterprise Storage 7.1 | perf | 5.3.18-150300.38.7.1 | SUSE-SU-2025:4096-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | binutils | 2.45-1.2 | openSUSE-SU-2025:15651-1 |
| openSUSE Leap 16.0 | binutils +25 | 2.45-160000.1.1 | openSUSE-SU-2025:20150-1 |
| openSUSE Leap 16.0 | bpftool | 7.5.0-160000.2.3 | openSUSE-SU-2025:20150-1 |
| openSUSE Leap 15.6 | binutils +24 | 2.45-150100.7.57.1 | SUSE-SU-2025:4096-1 |
| openSUSE Leap 15.6 | openucx | 1.15.0-150600.3.5.2 | SUSE-SU-2025:4096-1 |
| openSUSE Leap 15.6 | perf | 6.4.0.git33229.a3afe13a7f-150600.3.17.1 | SUSE-SU-2025:4096-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | binutils +2 | 2.41-50.amzn2023.0.3 | ALAS2023-2025-956 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | binutils | 2.41-4 | — |
| Azure Linux 3 | gdb | 13.2-9 | — |
| Azure Linux 2 (CBL-Mariner) | binutils | 2.37-13 | — |
| Azure Linux 2 (CBL-Mariner) | gdb | 11.2-4 | — |
Advisories 11
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- USN-7423-2 binutils vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7423-1 binutils vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2025:20150-1 Security update for binutils SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15651-1 binutils-2.45-1.2 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4096-1 Security update for binutils SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21197-1 Security update for binutils SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21195-1 Security update for binutils SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-0304 binutils: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2025
- ALAS2023-2025-956 Moderate: binutils security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 29, 2025
References
- VDB-295079 | GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow vdb-entry technical-description
- VDB-295079 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #495329 | GNU binutils/ld 2.43 Heap-based Buffer Overflow third-party-advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=32636 issue-tracking
- https://sourceware.org/bugzilla/attachment.cgi?id=15913 exploit
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814 patch
- https://www.gnu.org/ product