CVE-2025-1150 Details
Description
A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
A memory leak vulnerability has been identified in GNU Binutils version 2.43. This issue arises in the ld component, specifically within the bfd_malloc function of libbfd.c. The vulnerability allows for a remote memory leak, where the application fails to properly manage and release allocated memory, leading to increased memory consumption over time. Although the vulnerability is publicly known and has a proof-of-concept exploit available, its exploitation is considered difficult and requires user interaction.
Users are advised to apply the patch available in the GNU Binutils master branch to address this vulnerability. The vulnerability is also documented in the vulnerability database at Tenable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sourceware.org/bugzilla/attachment.cgi?id=15887 | [email protected] | Exploit |
| https://sourceware.org/bugzilla/show_bug.cgi?id=32576 | [email protected] | Issue Tracking |
| https://vuldb.com/?ctiid.295054 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.295054 | [email protected] | VDB Entry |
| https://www.gnu.org/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gnu binutils | 2.43 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2025 | Initial Analysis | [email protected] |
| Feb 10, 2025 | New CVE Received | [email protected] |