Memory Leak Vulnerability in GNU Binutils by GNU
CVE-2025-1150

2.3LOW

Key Information:

Vendor
Gnu
Status
Binutils
Vendor
CVE Published:
10 February 2025

Badges

👾 Exploit Exists

Summary

A memory leak vulnerability has been identified in GNU Binutils 2.43, specifically in the bfd_malloc function located in libbfd.c of the component ld. This flaw allows remote attackers to potentially exploit the vulnerability to create a persistent memory leak, which can degrade system performance and stability over time. While the complexity of executing this attack is relatively high, the information about this issue has been made publicly available, increasing its risk of exploitation. It is essential that users apply the recommended patches to mitigate this vulnerability, as the code maintainer has indicated that some fixes related to the memory leak will not be included in the 2.44 branch to avoid destabilizing ld.

Affected Version(s)

Binutils 2.43

References

https://vuldb.com/?id.295054
vdb-entrytechnical-description
https://vuldb.com/?ctiid.295054
signaturepermissions-required
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
issue-tracking

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.