CVE-2025-11839
Fixed in a distro release EPSS <1%CVSS 3.3
A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.
Products: gnu binutils, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | binutils | 2.45.1-r1 |
| Chainguard | binutils | 2.45.1-r0 |
| Chainguard | binutils-dev | 2.45.1-r1 |
| Chainguard | binutils-doc | 2.45.1-r0 |
| Chainguard | binutils-doc | 2.45.1-r1 |
| Chainguard | binutils-gold | 2.45.1-r1 |
| Chainguard | binutils-gold | 2.45.1-r0 |
| Debian 12 | binutils | no fix |
| Debian 13 | binutils | no fix |
| Debian 14 | binutils | 2.46-1 |
| Red Hat hummingbird 1 | binutils | 0:2.45.1-5.hum1 |
| Red Hat hummingbird 1 | binutils-devel | 0:2.45.1-5.hum1 |
| Red Hat hummingbird 1 | binutils-gold | 0:2.45.1-5.hum1 |
| Red Hat hummingbird 1 | binutils-gprofng | 0:2.45.1-5.hum1 |
| Ubuntu 22.04 LTS | binutils | 2.38-4ubuntu2.11 |
| Ubuntu 24.04 LTS | binutils | 2.42-4ubuntu2.7 |
| Ubuntu 25.10 | binutils | 2.45-7ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | binutils | 2.24-5ubuntu14.2+esm7 |
| Ubuntu Pro 16.04 LTS | binutils | 2.26.1-1ubuntu1~16.04.8+esm13 |
| Ubuntu Pro 18.04 LTS | binutils | 2.30-21ubuntu1~18.04.9+esm5 |
| Ubuntu Pro 20.04 LTS | binutils | 2.34-6ubuntu1.11+esm1 |
| Wolfi | binutils | 2.45.1-r0 |
| Wolfi | binutils | 2.45.1-r1 |
| Wolfi | binutils-dev | 2.45.1-r1 |
| Wolfi | binutils-doc | 2.45.1-r0 |
| Wolfi | binutils-doc | 2.45.1-r1 |
| Wolfi | binutils-gold | 2.45.1-r1 |
| Wolfi | binutils-gold | 2.45.1-r0 |
| openSUSE Tumbleweed | binutils | 2.47-1.1 |