Memory Leak Vulnerability in GNU Binutils by GNU
CVE-2025-1152

2.3LOW

Key Information:

Vendor

Gnu
Status
Binutils
Vendor
CVE Published:
10 February 2025

Badges

👾 Exploit Exists

What is CVE-2025-1152?

A memory leak has been discovered in the xstrdup function within the GNU Binutils component ld, specifically in version 2.43. This vulnerability can be exploited remotely, although the complexity of execution is considered high, making the attack challenging. Users are advised to apply patches to mitigate this issue, as the exploit has been disclosed publicly. The code maintainer noted reluctance in committing specific leak fixes to avoid destabilizing the ld component, but all known memory leak issues have been addressed in the binutils master branch.

Affected Version(s)

Binutils 2.43

References

https://vuldb.com/?id.295056
vdb-entrytechnical-description
https://vuldb.com/?ctiid.295056
signaturepermissions-required
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
issue-tracking

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.