PT-2026-1781 · Lief · Lief

Oneafter · Published 2026-01-10 · Updated 2026-04-30 · CVE-2025-15504

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lief-project LIEF versions up to 0.17.1

Description A security flaw exists in LIEF, specifically within the ELF Binary Parser component. The issue resides in the Parser::parse binary function located in the file src/ELF/Parser.tcc. This manipulation can lead to a null pointer dereference. The attack requires local access. An exploit for this issue has been publicly released.

Recommendations Upgrade to version 0.17.2 or later to resolve this issue.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2025-15504

GHSA-MJJP-XJFG-97WG

Affected Products

Lief

References · 17

• 🔥 https://github.com/lief-project/LIEF/issues/1277#issuecomment-3693859001 · Exploit
• 🔥 https://github.com/lief-project/LIEF/issues/1277 · Exploit
• 🔥 https://vuldb.com/?submit.733329 · Exploit
• 🔥 https://github.com/oneafter/1210/blob/main/segv1 · Exploit
• https://github.com/lief-project/LIEF/commit/81bd5d7ea0c390563f1c4c017c9019d154802978 · Patch
• https://github.com/lief-project/LIEF/releases/tag/0.17.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15504 · Security Note
• https://osv.dev/vulnerability/GHSA-mjjp-xjfg-97wg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15504 · Vendor Advisory
• https://github.com/lief-project/LIEF · Note
• https://t.me/CVEtracker/41943 · Telegram Post
• https://vuldb.com/?id.340375 · Note
• https://t.me/cveNotify/148352 · Telegram Post
• https://twitter.com/CVEnew/status/2009956069477380177 · Twitter Post
• https://vuldb.com/?ctiid.340375 · Note