GNU Binutils Linker out-of-bounds read may disrupt local linking

A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.

• GNU Binutils, Linker component: version 2.45 is confirmed affected.
• Upgrade to GNU Binutils 2.46 is identified as addressing the flaw.
• The record does not establish the status of other versions, parallel branches, or distribution builds outside these boundaries; later versions should not be assumed verified from this record alone.

The affected component is the Linker, specifically the elf_link_add_object_symbols function in bfd/elflink.c. The flaw is an out-of-bounds read classified as CWE-125; the record also lists CWE-119 for the broader memory-corruption class. The CNA analysis describes the processing path as occurring when the linker handles a specially crafted ELF object file during symbol processing. Exploitation requires local access to a system running the linker and does not require user interaction. Reading beyond the intended memory boundary can make the linker unstable or terminate unexpectedly. The exact data structure and boundary check changed by the patch are not established by the available evidence.

The record describes a locally exploitable flaw with low complexity, low required privileges, and no user interaction. The documented path involves supplying a specially crafted ELF input to the affected linker functionality. A public exploit has been reported and is described as usable, but the available evidence does not identify a specific campaign or real-world exploitation activity. The record does not establish direct network reachability.

A successful trigger can cause the linker to read outside the intended memory region, resulting in a crash, processing error, or interrupted build. Under some conditions, adjacent memory contents could be exposed, but the record does not confirm disclosure of sensitive information. Because exploitation is local, the primary exposure is on development hosts, build servers, and CI runners that process untrusted input. The available evidence does not establish code execution, privilege escalation, integrity modification, or propagation to another system.

The flaw can cause linker failures or interruptions, disrupting builds and potentially delaying software delivery. Risk is higher in automated CI or build services that process object files from external sources, where malicious input may enter through a user-controlled workspace or third-party dependency. An out-of-bounds read may expose adjacent memory contents in some execution conditions, but the available evidence does not confirm disclosure of any specific data type. The record does not establish privilege escalation, data modification, or direct impact on remote systems.

1. Upgrade affected GNU Binutils from version 2.45 to version 2.46, the release explicitly identified by the available evidence as addressing the flaw.
2. Prioritize build hosts, CI runners, and development systems that process untrusted ELF object files.
3. If an immediate upgrade is not possible, limit the processing of ELF files from untrusted sources by the local linker and treat those systems as exposed until the upgrade is complete.
4. The record does not provide a vendor-specific interim mitigation. The CNA identifies a patch in its source material, but this entry does not reproduce the patch hash.
5. Verify the package and binary version actually executed after updating. The status of other release branches requires separate confirmation from the vendor or distribution maintainer.

1. Inventory development hosts, build hosts, and CI jobs that install GNU Binutils, then identify the package version and the linker binary actually used.
2. Identify pipelines that invoke the linker on ELF object files from external sources, third-party dependencies, or workspaces writable by other users.
3. Review linker crashes, aborted link jobs, and failed builds associated with symbol processing. These are investigation leads, not confirmed indicators for this flaw.
4. After remediation, recheck the inventory to verify that in-scope systems use the supported fixed release.
5. Do not treat the absence of unusual log entries as proof of safety; version and input-processing-path checks remain the primary validation.