Memory Corruption Vulnerability in GNU Binutils - CVE-2025-1153
Summary
CVE-2025-1153: A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affects binutils across 3 version ranges.
< 2.43.1-r3
< 57f3676f3e5266829a91880d61143ab9ecd617bd
< 815d9a14cbbb3b81843f7566222c87fb22e7255d
Fixed in 2.43.1-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of binary tools essential for software development, including utilities for assembling, linking, and manipulating binary files. It is widely used in various operating systems, particularly in Unix-like environments. The vulnerability CVE-2025-1153 affects versions 2.43 and 2.44, where the function bfd_set_format in format.c is susceptible to memory corruption, potentially leading to severe security issues.
Vulnerability Detail
CVE-2025-1153 is a problematic vulnerability found in GNU Binutils versions 2.43 and 2.44. The issue arises from the bfd_set_format function in the format.c file, which can be exploited to cause memory corruption. This vulnerability can be triggered remotely, making it particularly dangerous. Although the complexity of the attack is high, successful exploitation could lead to unauthorized access or manipulation of system resources. The recommended solution is to upgrade to version 2.45, which addresses this vulnerability.
How To Fix
Minimum fixed version
2.43.1-r3
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
CVE-2025-1153 is a significant vulnerability in GNU Binutils that can lead to memory corruption if not addressed. Users are strongly advised to upgrade to version 2.45 or later to mitigate potential risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for binutils →
FAQ
CVE-2025-1153 is a memory corruption vulnerability found in GNU Binutils versions 2.43 and 2.44, which can be exploited remotely.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Failure to address this vulnerability could lead to unauthorized access, data manipulation, or system instability due to memory corruption.
Yes, upgrading to GNU Binutils version 2.45 or later will patch the vulnerability.
The CVSS score for CVE-2025-1153 is 3.1, indicating a low to moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
