CVE-2025-1148 — Missing Release of Memory after Effective Lifetime in Binutils

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-404 — Improper Resource Shutdown or ReleaseCWE-772 — Missing Release of Resource after Effective LifetimeCWE-457 — Use of Uninitialized Variable9 documents8 sources
Severity
2.3LOWNVD
EPSS
0.1%
top 78.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Binutils
Timeline
PublishedFeb 10
Latest updateOct 29

Description

A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not go…

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Debiangnu/binutils< 2.45-3
▶CVEListV5gnu/binutils2.43
▶NVDgnu/binutils2.43

🔴Vulnerability Details

3
CVEList
GNU Binutils ld ldelfgen.c link_order_scan memory leak↗2025-02-10
▶
GHSA
GHSA-gqj6-fppc-vr34: A vulnerability was found in GNU Binutils 2↗2025-02-10
▶
OSV
CVE-2025-1148: A vulnerability was found in GNU Binutils 2↗2025-02-10
▶

📋Vendor Advisories

5
Ubuntu
GNU binutils vulnerabilities↗2025-10-29
▶
Red Hat
kernel: pptp: ensure minimal skb length in pptp_xmit()↗2025-08-19
▶
Microsoft
GNU Binutils ld ldelfgen.c link_order_scan memory leak↗2025-02-11
▶
Red Hat
binutils: GNU Binutils ld ldelfgen.c link_order_scan memory leak↗2025-02-10
▶
Debian
CVE-2025-1148: binutils - A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Af...↗2025
▶
CVE-2025-1148 — GNU Binutils vulnerability | cvebase