CVE-2025-1149 — Missing Release of Memory after Effective Lifetime in Binutils

CWE-401 — Missing Release of Memory after Effective Lifetime CWE-404 — Improper Resource Shutdown or Release CWE-772 — Missing Release of Resource after Effective Lifetime7 documents7 sources

Severity

2.3LOWNVD

EPSS

0.0%

top 85.21%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

GNU Binutils

Timeline

PublishedFeb 10

Latest updateFeb 11

Description

A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm …

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Debiangnu/binutils< 2.45-3

▶CVEListV5gnu/binutils2.43

▶NVDgnu/binutils2.43

🔴Vulnerability Details

OSV

CVE-2025-1149: A vulnerability was found in GNU Binutils 2↗2025-02-10

▶

GHSA

GHSA-vwfw-r6qw-22rw: A vulnerability was found in GNU Binutils 2↗2025-02-10

▶

CVEList

GNU Binutils ld xmalloc.c xstrdup memory leak↗2025-02-10

▶

📋Vendor Advisories

Microsoft

GNU Binutils ld xmalloc.c xstrdup memory leak↗2025-02-11

▶

Red Hat

binutils: GNU Binutils ld xmalloc.c xstrdup memory leak↗2025-02-10

▶

Debian

CVE-2025-1149: binutils - A vulnerability was found in GNU Binutils 2.43. It has been classified as proble...↗2025

▶