A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 1.9 · gnuNVD modified 2026-10-08 13:10
Affected (CPE criteria) 1
cpe:2.3:a:gnu:binutils:2.45:*:*:*:*:*:*:*
References 9
- https://sourceware.org/bugzilla/attachment.cgi?id=16378 Broken Link
- https://sourceware.org/bugzilla/show_bug.cgi?id=33452 Exploit, Issue Tracking
- https://sourceware.org/bugzilla/show_bug.cgi?id=33452#c8 Exploit, Issue Tracking
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc Patch
- https://vuldb.com/?ctiid.327348 Permissions Required, VDB Entry
- https://vuldb.com/?id.327348 Third Party Advisory, VDB Entry
- https://www.gnu.org/ Third Party Advisory, VDB Entry
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://sourceware.org/bugzilla/show_bug.cgi?id=33452 Exploit, Issue Tracking