A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 1.9 · gnuNVD modified 2026-10-09 10:10
Affected (CPE criteria) 1
cpe:2.3:a:gnu:binutils:2.45:*:*:*:*:*:*:*
References 8
- https://sourceware.org/bugzilla/attachment.cgi?id=16351 Exploit
- https://sourceware.org/bugzilla/attachment.cgi?id=16357 Not Applicable
- https://sourceware.org/bugzilla/show_bug.cgi?id=33455 Exploit, Issue Tracking
- https://vuldb.com/?ctiid.328775 Permissions Required, VDB Entry
- https://vuldb.com/?id.328775 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.661281 Third Party Advisory, VDB Entry
- https://www.gnu.org/ Product
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html