CVE-2025-11839: gnu binutils Unchecked Return Value
Vulnerability summary
CVE-2025-11839 is a medium (CVSS 5.5) Unchecked Return Value vulnerability in gnu binutils. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 16-10-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.
CVSS metrics
12 scores · 6 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:RDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
- CWE-253Incorrect Check of Function Return ValueThe product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
Affected systems
Chainguard4 products
- binutils< 2.45.1-r0 | < 2.45.1-r1
- binutils-dev< 2.45.1-r1
- binutils-doc< 2.45.1-r0 | < 2.45.1-r1
- binutils-gold< 2.45.1-r1 | < 2.45.1-r0
Wolfi4 products
- binutils< 2.45.1-r0 | < 2.45.1-r1
- binutils-dev< 2.45.1-r1
- binutils-doc< 2.45.1-r0 | < 2.45.1-r1
- binutils-gold< 2.45.1-r1 | < 2.45.1-r0
Debian1 product
- binutilsAll versions (No fix recorded) | < 2.46-1
Gnu1 product
- binutils2.45
Ubuntu1 product
- binutils< 2.24-5ubuntu14.2+esm7 | < 2.26.1-1ubuntu1~16.04.8+esm13 | < 2.30-21ubuntu1~18.04.9+esm5 | < 2.34-6ubuntu1.11+esm1 | < 2.38-4ubuntu2.11 | < 2.42-4ubuntu2.7 | < 2.45-7ubuntu1.1
5 vendors · 11 products
