Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-7546

CVE-2025-7546LOW

GNU Binutils elf.c bfd_elf_set_group_contents out-of-bounds write

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0021   10.0     —

AFFECTED
  Product   Versions  Fixed
  Binutils  2.45 –    —

TIMELINE
  Jul 12  Reserved by VulDB
  Jul 13  Published (CNA: VulDB)
  Oct 15  RESCORED — CVE-2025-7546 (GNU Binutils). CVSS 4.8 → 1.9 (NVD).

CWE-119, CWE-787 · CNA: VulDB · CVSS v4.0 · 10 references · NVD status: Modified

Description

A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 12, 2025	Reserved	Reserved by VulDB
July 13, 2025	Published	Published (CNA: VulDB)
October 15, 2026	RESCORED	RESCORED — CVE-2025-7546 (GNU Binutils). CVSS 4.8 → 1.9 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
GNU	Binutils	—	2.45	—

Weaknesses

CWE-119 · CWE-787

References (10)

https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://sourceware.org/bugzilla/attachment.cgi?id=16118 [Broken Link]
https://sourceware.org/bugzilla/show_bug.cgi?id=33050 [Broken Link]
https://sourceware.org/bugzilla/show_bug.cgi?id=33050#c2 [Broken Link]
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b [Broken Link]
https://vuldb.com/?ctiid.316244 [Permissions Required, VDB Entry]
https://vuldb.com/?id.316244 [Third Party Advisory, VDB Entry]
https://vuldb.com/?submit.614375 [Third Party Advisory, VDB Entry]
https://www.gnu.org/ [Product]

Authoritative record: CVE-2025-7546 at cve.org

Vendors: gnu

Weaknesses: CWE-119 · CWE-787

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-7546 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.