CVE-2025-1150 — Missing Release of Memory after Effective Lifetime in Binutils

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-404 — Improper Resource Shutdown or ReleaseCWE-772 — Missing Release of Resource after Effective Lifetime7 documents7 sources
Severity
2.3LOWNVD
EPSS
0.0%
top 85.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Binutils
Timeline
PublishedFeb 10
Latest updateFeb 11

Description

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not goin…

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Debiangnu/binutils< 2.45-3
▶CVEListV5gnu/binutils2.43
▶NVDgnu/binutils2.43

🔴Vulnerability Details

3
GHSA
GHSA-8q6p-chgp-9j92: A vulnerability was found in GNU Binutils 2↗2025-02-10
▶
CVEList
GNU Binutils ld libbfd.c bfd_malloc memory leak↗2025-02-10
▶
OSV
CVE-2025-1150: A vulnerability was found in GNU Binutils 2↗2025-02-10
▶

📋Vendor Advisories

3
Microsoft
GNU Binutils ld libbfd.c bfd_malloc memory leak↗2025-02-11
▶
Red Hat
binutils: GNU Binutils ld libbfd.c bfd_malloc memory leak↗2025-02-10
▶
Debian
CVE-2025-1150: binutils - A vulnerability was found in GNU Binutils 2.43. It has been declared as problema...↗2025
▶
CVE-2025-1150 — GNU Binutils vulnerability | cvebase