A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation with an unknown input leads to a memory leak vulnerability. Using CWE to declare the problem leads to CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. Impacted is availability.

It is possible to read the advisory at sourceware.org. The identification of this vulnerability is CVE-2025-1151. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The exploit is available at sourceware.org. It is declared as proof-of-concept. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." The vulnerability scanner Nessus provides a plugin with the ID 232176 (Linux Distros Unpatched Vulnerability : CVE-2025-1151), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (232176). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• Binutils

Version

• 2.43

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion