Every CVE Search/ Get API key

CVE-2025-11081

GNU Binutils objdump.c dump_dwarf_section out-of-bounds

4.8 MediumFix available

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.21%Up 0.2 points since Sep 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

GNU Binutils objdump.c dump_dwarf_section out-of-bounds

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
CVE-2025-11081
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-125, CWE-119
Updated
2026-11-02
EUVDEUVD-2025-31443 4.8

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
EUVD-2025-31443
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-q5cj-48g5-f774 1.9

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function...

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
GHSA-q5cj-48g5-f774
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 1.9

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
CVE-2025-11081
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSVBELL-CVE-2025-11081 5.5
Record
BELL-CVE-2025-11081
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 1.9

GNU Binutils objdump.c dump_dwarf_section out-of-bounds

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
CVE-2025-11081
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-125
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2025-11081 5.5

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
DEBIAN-CVE-2025-11081
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7098 5.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7098
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-11081 5.5

CVE-2025-11081 in binutils - Patched by Root

Root has patched CVE-2025-11081 in the binutils package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-11081
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-11081 1.9

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

Record
UBUNTU-CVE-2025-11081
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUSN-7919-1 No score

binutils vulnerabilities

It was discovered that GNU binutils' dump_dwarf_section function could be manipulated to perform an out-of-bounds read. A local attacker could possibly use this issue to cause GNU binutils to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-11081)

It was discovered that GNU binutils incorrectly handled certain files. A local attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 25.10. (CVE-2025-11082)

It was discovered that GNU binutils incorrectly handled certain inputs. A local attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue was only fixed in Ubuntu 25.10. (CVE-2025-11083)

It was discovered that certain GNU binutils functions could be manipulated to perform out-of-bounds reads. A local attacker could possibly use this issue to cause GNU binutils to crash, resulting in a denial of service. (CVE-2025-11412, CVE-2025-11413, CVE-2025-11414)

It was discovered that GNU binutils' _bfd_x86_elf_late_size_sections function could be manipulated to perform an out-of-bounds read. A local attacker could possibly use this issue to cause GNU binutils to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-11494)

It was discovered that GNU binutils' elf_x86_64_relocate_section function could be manipulated to cause a heap-based buffer overflow. A local attacker could possibly use this issue to cause GNU binutils to crash, resulting in a denial of service. This issue was only fixed in Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-11495)

Record
USN-7919-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
binutils
Alpaquita:25
 2.45-r0 up to 2.45-r3
2.45-r3
binutils
Alpaquita:stream
 2.45-r0 up to 2.45.1-r1
2.45.1-r1
binutils
BellSoft Hardened Containers:25
 2.45-r0 up to 2.45-r3
2.45-r3
binutils
BellSoft Hardened Containers:stream
 2.45-r0 up to 2.45.1-r1
2.45.1-r1
binutils
Debian:12
 All versions, plus listed versions
2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1
Show 45 moreShow less
2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1
 None known
binutils
Debian:13
 All versions, plus listed versions
2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2
Show 45 moreShow less
2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47-32.47-42.47-52.47-62.47.50.20260813-12.47.50.20260813-2
 None known
binutils
Debian:14
 before 2.46-1, plus listed versions
2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2
Show 28 moreShow less
2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-1
2.46-1
binutils
Red Hat:hummingbird:1
From an advisory covering 25 CVEs
 before 0:2.45.1-5.hum1
0:2.45.1-5.hum1
binutils-devel
Red Hat:hummingbird:1
From an advisory covering 25 CVEs
 before 0:2.45.1-5.hum1
0:2.45.1-5.hum1
binutils-gold
Red Hat:hummingbird:1
From an advisory covering 25 CVEs
 before 0:2.45.1-5.hum1
0:2.45.1-5.hum1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
binutils-gprofng
Red Hat:hummingbird:1
From an advisory covering 25 CVEs
 before 0:2.45.1-5.hum1
0:2.45.1-5.hum1
binutils
Root:Debian:12
 before 2.40-2.root.io.16
2.40-2.root.io.162.40-2.root.io.172.40-2.root.io.182.40-2.root.io.192.40-2.root.io.202.40-2.root.io.212.40-2.root.io.222.40-2.root.io.232.40-2.root.io.242.40-2.aikido.25
rootio-binutils
Root:Debian:12
 before 2.40-2.root.io.16
2.40-2.root.io.162.40-2.root.io.172.40-2.root.io.182.40-2.root.io.192.40-2.root.io.202.40-2.root.io.212.40-2.root.io.222.40-2.root.io.232.40-2.root.io.242.40-2.aikido.25
binutils
Ubuntu:25.10
 before 2.45-7ubuntu1.2, plus listed versions
2.44-3ubuntu12.44.50.20250602-0ubuntu12.44.50.20250604-0ubuntu22.44.50.20250616-0ubuntu12.44.50.20250707-1ubuntu1
Show 5 moreShow less
2.45-1ubuntu12.45-3ubuntu32.45-6ubuntu12.45-7ubuntu12.45-7ubuntu1.1
2.45-7ubuntu1.2
binutils
Ubuntu:Pro:14.04:LTS
 before 2.24-5ubuntu14.2+esm8, plus listed versions
2.23.52.20130913-0ubuntu12.23.90.20131017-1ubuntu12.23.90.20131116-1ubuntu12.23.91.20131123-1ubuntu12.24-1ubuntu1
Show 19 moreShow less
2.24-1ubuntu22.24-2ubuntu12.24-2ubuntu22.24-2ubuntu32.24-4ubuntu12.24-5ubuntu12.24-5ubuntu22.24-5ubuntu32.24-5ubuntu3.12.24-5ubuntu132.24-5ubuntu142.24-5ubuntu14.12.24-5ubuntu14.22.24-5ubuntu14.2+esm12.24-5ubuntu14.2+esm22.24-5ubuntu14.2+esm32.24-5ubuntu14.2+esm52.24-5ubuntu14.2+esm62.24-5ubuntu14.2+esm7
2.24-5ubuntu14.2+esm8
binutils
Ubuntu:Pro:16.04:LTS
 before 2.26.1-1ubuntu1~16.04.8+esm14, plus listed versions
2.25.1-6ubuntu12.25.51.20151022-0ubuntu22.25.51.20151022-0ubuntu32.25.51.20151027-0ubuntu12.25.51.20151028-0ubuntu1
Show 36 moreShow less
2.25.51.20151106-0ubuntu12.25.51.20151113-1ubuntu12.25.51.20151113-2ubuntu12.25.90.20151125-1ubuntu12.25.90.20151125-2ubuntu12.25.90.20151211-0ubuntu12.25.90.20151211-0ubuntu22.25.90.20160101-1ubuntu12.25.90.20160101-1ubuntu22.26-2ubuntu12.26-3ubuntu12.26-4ubuntu12.26-5ubuntu12.26-6ubuntu12.26-7ubuntu22.26-8ubuntu12.26-8ubuntu22.26-8ubuntu2.12.26.1-1ubuntu1~16.042.26.1-1ubuntu1~16.04.12.26.1-1ubuntu1~16.04.32.26.1-1ubuntu1~16.04.42.26.1-1ubuntu1~16.04.52.26.1-1ubuntu1~16.04.62.26.1-1ubuntu1~16.04.72.26.1-1ubuntu1~16.04.82.26.1-1ubuntu1~16.04.8+esm12.26.1-1ubuntu1~16.04.8+esm32.26.1-1ubuntu1~16.04.8+esm42.26.1-1ubuntu1~16.04.8+esm52.26.1-1ubuntu1~16.04.8+esm62.26.1-1ubuntu1~16.04.8+esm72.26.1-1ubuntu1~16.04.8+esm92.26.1-1ubuntu1~16.04.8+esm112.26.1-1ubuntu1~16.04.8+esm122.26.1-1ubuntu1~16.04.8+esm13
2.26.1-1ubuntu1~16.04.8+esm14
binutils
Ubuntu:Pro:18.04:LTS
 before 2.30-21ubuntu1~18.04.9+esm13, plus listed versions
2.29.1-4ubuntu12.29.1-6ubuntu12.29.1-7ubuntu12.29.1-8ubuntu12.29.1-10ubuntu1
Show 24 moreShow less
2.29.1-12ubuntu12.30-4ubuntu12.30-5ubuntu12.30-7ubuntu12.30-8ubuntu12.30-9ubuntu12.30-10ubuntu12.30-11ubuntu12.30-14ubuntu22.30-15ubuntu12.30-20ubuntu2~18.042.30-21ubuntu1~18.042.30-21ubuntu1~18.04.12.30-21ubuntu1~18.04.22.30-21ubuntu1~18.04.32.30-21ubuntu1~18.04.42.30-21ubuntu1~18.04.52.30-21ubuntu1~18.04.72.30-21ubuntu1~18.04.82.30-21ubuntu1~18.04.92.30-21ubuntu1~18.04.9+esm12.30-21ubuntu1~18.04.9+esm32.30-21ubuntu1~18.04.9+esm42.30-21ubuntu1~18.04.9+esm5
2.30-21ubuntu1~18.04.9+esm13
binutils
Ubuntu:Pro:20.04:LTS
 before 2.34-6ubuntu1.11+esm2, plus listed versions
2.33-2ubuntu12.33.1-1ubuntu12.33.1-5ubuntu12.33.1-6ubuntu12.33.1-6ubuntu3
Show 17 moreShow less
2.33.90.20200122-1ubuntu22.34-1ubuntu12.34-3ubuntu12.34-4ubuntu12.34-5ubuntu12.34-6ubuntu12.34-6ubuntu1.12.34-6ubuntu1.32.34-6ubuntu1.42.34-6ubuntu1.52.34-6ubuntu1.62.34-6ubuntu1.72.34-6ubuntu1.82.34-6ubuntu1.92.34-6ubuntu1.102.34-6ubuntu1.112.34-6ubuntu1.11+esm1
2.34-6ubuntu1.11+esm2
binutils
Ubuntu:22.04:LTS
 before 2.38-4ubuntu2.12, plus listed versions
2.37-7ubuntu12.37-9ubuntu12.37-10ubuntu12.37.50.20220106-2ubuntu12.37.90.20220126-0ubuntu1
Show 15 moreShow less
2.37.90.20220130-0ubuntu22.38-1ubuntu12.38-2ubuntu12.38-3ubuntu12.38-4ubuntu22.38-4ubuntu2.12.38-4ubuntu2.22.38-4ubuntu2.32.38-4ubuntu2.42.38-4ubuntu2.52.38-4ubuntu2.62.38-4ubuntu2.72.38-4ubuntu2.82.38-4ubuntu2.102.38-4ubuntu2.11
2.38-4ubuntu2.12
binutils
Ubuntu:24.04:LTS
 before 2.42-4ubuntu2.8, plus listed versions
2.41-5ubuntu12.41-6ubuntu12.41.50.20231206-1ubuntu12.41.50.20231214-1ubuntu12.41.50.20231227-1ubuntu1
Show 10 moreShow less
2.41.90.20240122-1ubuntu12.42-2ubuntu12.42-3ubuntu12.42-4ubuntu12.42-4ubuntu22.42-4ubuntu2.32.42-4ubuntu2.42.42-4ubuntu2.52.42-4ubuntu2.62.42-4ubuntu2.7
2.42-4ubuntu2.8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11081 is a medium vulnerability (CVSS 4.8) in Gnu Binutils, published September 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in binutils 2.45-r3.

References

Show 183 moreShow less
This page doesn't list everything

Left out here: 80 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open