Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
Azure binutils can cause remote memory leak
published 1 year ago
Summary
The linker component (ld) in Azure binutils version 2.41-13 has a bug that can leak memory when crafted data is processed, and an attacker could trigger it from a distance, though doing so is difficult. This could degrade system performance or lead to denial of service. Apply the available patch or upgrade to a newer binutils release to close the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | binutils | <= 2.41-13 |
Original advisory text
CVE-2025-1152 affecting package binutils 2.41-13
A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published10 Feb 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-56573 · OSV
Track software like this
Free during beta