CVE details
CVE-2025-5244
A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.
Affected ports (19)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| devel/binutils | aarch64-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | aarch64-none-elf-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | amd64-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | arm-gnueabi-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | arm-none-eabi-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | avr-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | i386-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | mingw32-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | powerpc-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | powerpc64-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | powerpc64le-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | riscv32-unknown-elf-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | riscv64-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | riscv64-none-elf-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| devel/binutils | s390x-binutils | 2.44,1 | unaddressed | cy@FreeBSD.org |
| lang/gnatcross-binutils-aarch64 | gnatcross-binutils-aarch64 | 2.27_1 | unaddressed | ports@FreeBSD.org |
| lang/gnatdroid-binutils | gnatdroid-binutils | 2.27_1 | unaddressed | jamie@catflap.org |
| lang/gnatdroid-binutils-x86 | gnatdroid-binutils-x86 | 2.27_1 | unaddressed | ports@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>aarch64-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>aarch64-none-elf-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>amd64-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>arm-gnueabi-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>arm-none-eabi-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>avr-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>i386-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>mingw32-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>powerpc-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>powerpc64-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>powerpc64le-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>riscv32-unknown-elf-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>riscv64-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>riscv64-none-elf-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>s390x-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>gnatcross-binutils-aarch64</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>gnatdroid-binutils</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>gnatdroid-binutils-x86</name>
<range><lt>2.45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A vulnerability was found in GNU Binutils up to 2.44. It has been
rated as critical. Affected by this issue is the function elf_gc_sweep
of the file bfd/elflink.c of the component ld. The manipulation leads
to memory corruption. An attack has to be approached locally. The
exploit has been disclosed to the public and may be used. Upgrading to
version 2.45 is able to address this issue. It is recommended to
upgrade the affected component.</p>
</body>
</description>
<references>
<cvename>CVE-2025-5244</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-5244</url>
</references>
<dates>
<discovery>2025-05-27</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>