PT-2025-6045 · Gnu+4 · Gnu Binutils+4

Wenjusun · Published 2025-01-20 · Updated 2025-12-12 · CVE-2025-1148

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43

Description A memory leak issue was found in the link order scan function of the ld component, specifically in the file ld/ldelfgen.c. This issue can be exploited remotely, but the complexity of an attack is rather high, and the exploitation is known to be difficult. The attack leads to a memory leak.

Recommendations For GNU Binutils version 2.43, it is recommended to apply a patch to fix this issue. As a temporary workaround, consider disabling the link order scan function until a patch is available.

Exploit

Fix

Improper Resource Release

Memory Leak

Weakness Enumeration

CWE-404

CWE-401

Related Identifiers

AZL-56777

AZL-56788

BDU:2026-02737

CVE-2025-1148

ECHO-A9C2-05D4-9400

OPENSUSE-SU-2025:15651-1

OPENSUSE-SU-2025:20150-1

SUSE-SU-2025:21195-1

SUSE-SU-2025:21197-1

SUSE-SU-2025:4096-1

USN-7847-1

Affected Products

Debian

Gnu Binutils

Linuxmint

Suse

Ubuntu

References · 104

• 🔥 https://vuldb.com/?submit.485747 · Exploit
• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=15887 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=32576 · Exploit
• https://osv.dev/vulnerability/AZL-56788 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15651-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7847-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4096-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-1148 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8225 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1148 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21197-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5245 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20150-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1148 · Security Note