CVE-2025-1152
Gnu Binutils 2.43
Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-1152 is a low-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Gnu Binutils. Its CVSS base score is 2.3 (Low).
Operationally, ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2027
Vulnerability Data
A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The…
more
complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the recommended patch to remediate the memory-leak flaw in ld before the vulnerable Binutils 2.43 binary is used.
Enforces configuration settings that restrict ld to only approved, patched Binutils versions or disable vulnerable code paths.
Implements memory-protection safeguards that can contain or mitigate the effects of the xstrdup memory leak during linking operations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper memory allocation/deallocation via coding standards, reviews, and tooling.
Runtime monitoring can detect resource exhaustion caused by improper shutdown or release.
Lifecycle management of assets can encompass proper resource release at end-of-life or shutdown.
Capacity management helps surface leaks from unreleased resources but does not prevent the coding flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unreleased memory, providing partial coverage of the weakness.
Including restart, recovery and media-handling instructions reduces the likelihood that resources or sensitive data will be left in an exposed or improperly released state after a failure.
Secure development life cycle mandates memory-management practices that reduce missing-release defects.
Application security requirements can specify explicit memory-release rules, partially mitigating the weakness.
Secure system architecture and engineering principles include resource-management guidelines that address memory leaks.
Secure coding standards directly require proper allocation/deallocation, covering most of this weakness.