Moderate Security Vulnerability in gcc-toolset-15-binutils: Heap-Based Overflow
Summary
RLSA-2026:1359: Moderate: gcc-toolset-15-binutils security update. Affects gcc-toolset-15-binutils versions < 0:2.44-3.el9_7.1. Fixed in 0:2.44-3.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gcc-toolset-15-binutils is a part of the GNU Binutils collection, which includes essential tools for handling binary files. These tools are widely used for creating, modifying, and analyzing object files and archives. The package provides functionalities such as linking, assembling, and profiling, making it crucial for software development and deployment. However, it is susceptible to a heap-based overflow vulnerability that can potentially compromise system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-11083 is a heap-based overflow in the GNU Binutils Linker. This issue arises from improper handling of memory allocation, which can lead to arbitrary code execution or data corruption. Attackers exploiting this vulnerability could manipulate the linker to execute malicious code, posing a significant risk to systems utilizing the affected package. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:2.44-3.el9_7.1
This is the first release that contains the fix.
sudo dnf update gcc-toolset-15-binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionalities of the binutils package until the update is applied. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The gcc-toolset-15-binutils package has a moderate security vulnerability (CVE-2025-11083) that can lead to heap-based overflow. Users are advised to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gcc-toolset-15-binutils →
FAQ
CVE-2025-11083 is a security vulnerability in the GNU Binutils Linker that allows for a heap-based overflow, potentially leading to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update the package immediately, avoid using the functionalities of the binutils package that are affected by this vulnerability as a temporary workaround.
The security fix is provided by the Rocky Enterprise Software Foundation and Red Hat, who maintain the gcc-toolset-15-binutils package.
Related vulnerabilities
Recent vulnerabilities recorded for gcc-toolset-15-binutils.
