CVE-2025-11840

A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.

• CWE-119
• CWE-125
• CWE-125

• https://sourceware.org/bugzilla/attachment.cgi?id=16351Exploit
• https://sourceware.org/bugzilla/attachment.cgi?id=16357Not Applicable
• https://sourceware.org/bugzilla/show_bug.cgi?id=33455Exploit, Issue Tracking
• https://vuldb.com/?ctiid.328775Permissions Required, VDB Entry
• https://vuldb.com/?id.328775Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.661281Third Party Advisory, VDB Entry
• https://www.gnu.org/Product
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Published

Oct 16, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11834The WP AD Gallery plugin for WordPress is vulnerable to Stor…6.4
• CVE-2025-11835The Paid Membership Subscriptions – Effortless Memberships, …5.3
• CVE-2025-11837An improper control of generation of code vulnerability has …9.8
• CVE-2025-11838A memory corruption vulnerability in WatchGuard Fireware OS …7.5
• CVE-2025-11839A security flaw has been discovered in GNU Binutils 2.45. Im…5.5
• CVE-2025-1184A vulnerability was found in pihome-shc PiHome 1.77 and clas…8.8
• CVE-2025-11841The Greenshift – animation and page builder blocks plugin fo…6.4
• CVE-2025-11842A security vulnerability has been detected in Shazwazza Smid…6.3
• CVE-2025-11843Therefore Corporation GmbH has recently become aware that Th…8.8
• CVE-2025-11844Hugging Face Smolagents version 1.20.0 contains an XPath inj…5.4
• CVE-2025-11845A null pointer dereference vulnerability in the certificate …4.9
• CVE-2025-11846A null pointer dereference vulnerability in the account sett…4.9