CVE catalog
CVE-2025-1148
GNU binutils vulnerabilities
- Severity
- Low · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.64% · Oct 25, 2026
A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | binutils | sid | 2.47.50.20261021-1 | fixed |
| Debian | binutils | forky | 2.47.50.20261021-1 | fixed |
| Debian | binutils | trixie | 2.44-3 | vulnerable |
| Debian | binutils | bookworm | 2.40-2 | vulnerable |
| Ubuntu | binutils | noble | Not reported | vulnerable |
| Ubuntu | binutils | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-aarch64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-alpha-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-arc-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-arm-linux-gnueabi | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-arm-linux-gnueabihf | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-common | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-dev | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-doc | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-for-build | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-for-host | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-hppa-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-hppa64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-i686-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-i686-kfreebsd-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-i686-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-ia64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-loongarch64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-m68k-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-multiarch | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-multiarch-dev | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-powerpc-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-powerpc64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-powerpc64le-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-riscv64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-s390x-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-sh4-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-source | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-sparc64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-x86-64-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-x86-64-kfreebsd-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-x86-64-linux-gnu | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils-x86-64-linux-gnux32 | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | libbinutils | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | libctf-nobfd0 | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | libctf0 | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | libgprofng0 | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | libsframe1 | noble | 2.42-4ubuntu2.6 | fixed |
| Ubuntu | binutils | pro | 2.33-2ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.33.1-1ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.33.1-5ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.33.1-6ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.33.1-6ubuntu3 | vulnerable |
| Ubuntu | binutils | pro | 2.33.90.20200122-1ubuntu2 | vulnerable |
| Ubuntu | binutils | pro | 2.34-1ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-3ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-4ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-5ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.3 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.4 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.5 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.6 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.7 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.8 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.9 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.10 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.11 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.11+esm1 | vulnerable |
| Ubuntu | binutils | pro | 2.34-6ubuntu1.11+esm2 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.37-7ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.37-9ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.37-10ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.37.50.20220106-2ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.37.90.20220126-0ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.37.90.20220130-0ubuntu2 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-1ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-2ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-3ubuntu1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.1 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.2 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.3 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.4 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.5 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.6 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.7 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.8 | vulnerable |
| Ubuntu | binutils | 22.04 | 2.38-4ubuntu2.10 | fixed |
| Ubuntu | binutils | 24.04 | 2.41-5ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.41-6ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.41.50.20231206-1ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.41.50.20231214-1ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.41.50.20231227-1ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.41.90.20240122-1ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-2ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-3ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-4ubuntu1 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-4ubuntu2 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-4ubuntu2.3 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-4ubuntu2.4 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-4ubuntu2.5 | vulnerable |
| Ubuntu | binutils | 24.04 | 2.42-4ubuntu2.6 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | binutils | source | sid | 2.45-3 | unimportant | Not reported | Not reported |
| Debian | binutils | source | forky | 2.45-3 | unimportant | Not reported | Not reported |
| Debian | binutils | source | trixie | (unfixed) | unimportant | Not reported | Not reported |
| Debian | binutils | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
| Ubuntu | binutils | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-aarch64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-alpha-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-arc-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-arm-linux-gnueabi | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-arm-linux-gnueabihf | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-common | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-dev | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-doc | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-for-build | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-for-host | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-hppa-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-hppa64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-i686-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-i686-kfreebsd-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-i686-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-ia64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-loongarch64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-m68k-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-multiarch | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-multiarch-dev | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-powerpc-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-powerpc64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-powerpc64le-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-riscv64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-s390x-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-sh4-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-source | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-sparc64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-x86-64-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-x86-64-kfreebsd-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-x86-64-linux-gnu | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils-x86-64-linux-gnux32 | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | libbinutils | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | libctf-nobfd0 | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | libctf0 | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | libgprofng0 | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | libsframe1 | deb | noble | 2.42-4ubuntu2.6 | Not reported | Not reported | Not reported |
| Ubuntu | binutils | deb | 22.04 | 2.38-4ubuntu2.10 | Not reported | UBUNTU-CVE-2025-1148 | Not reported |
| Ubuntu | binutils | deb | 24.04 | 2.42-4ubuntu2.6 | Not reported | UBUNTU-CVE-2025-1148 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [binutils]Affected
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-aarch64-linux-gnu]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-aarch64-linux-gnu-dbg]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-alpha-linux-gnu]Affected
Source package: [binutils]
Details (1)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-alpha-linux-gnu-dbg]Affected
Source package: [binutils]
Details (1)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-arc-linux-gnu]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-arc-linux-gnu-dbg]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-arm-linux-gnueabi]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-arm-linux-gnueabi-dbg]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-arm-linux-gnueabihf]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-arm-linux-gnueabihf-dbg]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-common]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-dev]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-doc]Affected
Source package: [binutils]
Details (2)
2.40-2· all · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· all · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-for-build]Affected
Source package: [binutils]
Details (2)
2.40-2· all · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· all · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-for-host]Affected
Source package: [binutils]
Details (2)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
2.40-2· arm64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-hppa64-linux-gnu]Affected
Source package: [binutils]
Details (1)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-hppa64-linux-gnu-dbg]Affected
Source package: [binutils]
Details (1)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-hppa-linux-gnu]Affected
Source package: [binutils]
Details (1)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
- [binutils-hppa-linux-gnu-dbg]Affected
Source package: [binutils]
Details (1)
2.40-2· amd64 · bookwormAffected
usn · binutils · debian · bookworm; usn · binutils · debian · 12
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_21195-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-1148]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-1148]
- [https://security-tracker.debian.org/tracker/CVE-2025-1148]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-1148.json]
- [https://ubuntu.com/security/notices/USN-7847-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1730.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]