GNU binutils vulnerabilities

Latest GNU binutils CVEs

Newest publication first · page 3 of 12

1. CVE-2025-1180 GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruption

   Published 2025-02-11

   Low·CVSS 2.3 EPSS 0.70%

   A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely...

2. CVE-2025-1179 GNU Binutils ld libbfd.c bfd_putl64 memory corruption

   Published 2025-02-11

   Low·CVSS 2.3 EPSS 0.57%

   A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an at...

3. CVE-2025-1178 GNU Binutils ld libbfd.c bfd_putl64 memory corruption

   Published 2025-02-11

   Medium·CVSS 6.3 EPSS 0.80%

   A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexit...

4. CVE-2025-1176 GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow

   Published 2025-02-11

   Low·CVSS 2.3 EPSS 0.67%

   A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity o...

5. CVE-2025-1153 GNU Binutils format.c bfd_set_format memory corruption

   Published 2025-02-10

   Low·CVSS 2.3 EPSS 1.4%

   A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rath...

6. CVE-2025-1152 GNU Binutils ld xstrdup.c xstrdup memory leak

   Published 2025-02-10

   Low·CVSS 2.3 EPSS 0.61%

   A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather hi...

7. CVE-2025-1151 GNU Binutils ld xmemdup.c xmemdup memory leak

   Published 2025-02-10

   Low·CVSS 2.3 EPSS 0.61%

   A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather...

8. CVE-2025-1150 GNU Binutils ld libbfd.c bfd_malloc memory leak

   Published 2025-02-10

   Low·CVSS 2.3 EPSS 0.61%

   A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an atta...

9. CVE-2025-1149 GNU Binutils ld xmalloc.c xstrdup memory leak

   Published 2025-02-10

   Low·CVSS 2.3 EPSS 0.58%

   A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of a...

10. CVE-2025-1148 GNU Binutils ld ldelfgen.c link_order_scan memory leak

    Published 2025-02-10

    Low·CVSS 2.3 EPSS 0.64%

    A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an att...

11. CVE-2025-1147 GNU Binutils nm nm.c internal_strlen buffer overflow

    Published 2025-02-10

    Low·CVSS 2.3 EPSS 0.67%

    A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attac...

12. CVE-2025-0840 GNU Binutils objdump.c disassemble_bytes stack-based overflow

    Published 2025-01-29

    Medium·CVSS 6.3 EPSS 0.76%

    A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack...

13. CVE-2023-25584 Out of bounds read in parse_module function in bfd/vms-alpha.c

    Published 2023-09-14

    High·CVSS 7.1 EPSS 0.38%

    An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

14. CVE-2023-25585 Field `file_table` of `struct module *module` is uninitialized

    Published 2023-09-14

    Medium·CVSS 5.5 EPSS 0.38%

    A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

15. CVE-2023-25586 Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized

    Published 2023-09-14

    Medium·CVSS 5.5 EPSS 0.35%

    A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

16. CVE-2023-25588 Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`

    Published 2023-09-14

    Medium·CVSS 5.5 EPSS 0.38%

    A flaw was found in Binutils. The field the_bfd of asymbolstruct is uninitialized in the bfd_mach_o_get_synthetic_symtab function, which may lead to an application crash and local denial of service.

17. CVE-2022-48065 GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.

    Published 2023-08-22

    Medium·CVSS 5.5 EPSS 0.64%

    GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.

18. CVE-2022-48064 GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted...

    Published 2023-08-22

    Medium·CVSS 5.5 EPSS 0.61%

    GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

19. CVE-2022-47696 An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

    Published 2023-08-22

    High·CVSS 7.8 EPSS 0.42%

    An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

20. CVE-2022-47695 An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.

    Published 2023-08-22

    High·CVSS 7.8 EPSS 0.45%

    An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.

21. CVE-2022-47673 An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.

    Published 2023-08-22

    High·CVSS 7.8 EPSS 0.42%

    An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.

22. CVE-2022-45703 Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.

    Published 2023-08-22

    High·CVSS 7.8 EPSS 0.49%

    Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.

23. CVE-2022-44840 Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.

    Published 2023-08-22

    High·CVSS 7.8 EPSS 0.49%

    Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.

24. CVE-2022-35206 Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.

    Published 2023-08-22

    Medium·CVSS 5.5 EPSS 0.33%

    Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.

25. CVE-2021-46174 Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.

    Published 2023-08-22

    High·CVSS 7.5 EPSS 0.82%

    Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.