CVE-2025-1149: gnu binutils
Vulnerability summary
CVE-2025-1149 is a low (CVSS 3.1) vulnerability in gnu binutils. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.3% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 10-02-2025PublishedVulnerability first disclosed.
- 10-02-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST2.6LowAV:N/AC:H/Au:N/C:N/I:N/A:P
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
Affected systems
Debian1 product
- binutilsAll versions (No fix recorded) | < 2.45-3
Gnu1 product
- binutils2.43
Ubuntu1 product
- binutilsAll versions (No fix recorded)
3 vendors · 3 products
