CVE-2025-11081

An out of bounds read flaw has been discovered in GNU bin utilities. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access.

Moderate impact: Red Hat's current affects records cover RHEL, platforms, cloud, OpenShift, services, Community Projects, and Red Hat Hardened Images. A local user with low privileges who supplies crafted input to GNU Binutils' dump_dwarf_section function in binutils/objdump.c can trigger an out-of-bounds read. Red Hat's CVSS 3.1 assessment is Moderate (5.3), higher than the upstream Low (3.3), because Red Hat assesses low potential confidentiality, integrity, and availability impact; the upstream assessment reports only low availability impact. For affected entries marked DEFER, remediation is deferred in the current product assessment, with no more specific reason recorded; residual risk remains for local processing of crafted input. For delegated entries marked AFFECTED, remediation is being pursued by the responsible project. Some delegated entries are marked NOTAFFECTED, meaning those project assessments do not consider the corresponding product affected; the current record does not provide a more specific technical rationale.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.