Remote Memory Leak Vulnerability in GNU Binutils by GNU
CVE-2025-1149

2.3LOW

Key Information:

Vendor
Gnu
Status
Binutils
Vendor
CVE Published:
10 February 2025

Badges

👾 Exploit Exists

Summary

A remote memory leak vulnerability exists in GNU Binutils version 2.43, specifically within the xstrdup function in libiberty/xmalloc.c of the ld component. The vulnerability can be exploited remotely, making it a risk for systems utilizing this version. Although the complexity of successfully executing an attack is relatively high, the disclosed exploit has been made publicly accessible. It is essential to apply patches to mitigate this vulnerability, though the maintainer has indicated caution in committing leak fixes to the 2.44 branch, prioritizing system stability. All reported leaks have been resolved in the binutils master branch.

Affected Version(s)

Binutils 2.43

References

https://vuldb.com/?id.295053
vdb-entrytechnical-description
https://vuldb.com/?ctiid.295053
signaturepermissions-required
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
issue-tracking

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.