Vulnerability in Gnu Binutils
CVE-2025-3198
A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.
EPSS: 0.003 (17.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Gnu Binutils — versions 2.43, 2.44
Weakness classification (CWE)
Public proof-of-concept exploits
References
- VDB-303151 | GNU Binutils objdump bucomm.c display_info memory leak (technical-description, Third Party Advisory, VDB Entry, vdb-entry)
- VDB-303151 | CTI Indicators (IOB, IOC, IOA) (signature, Permissions Required, permissions-required, VDB Entry)
- Submit #545773 | GNU Library Objdump in Binutil 2.44 and 2.43 (also other possible downward versions) Memory Leak (Exploit, Third Party Advisory, VDB Entry, third-party-advisory)
- cna@vuldb.com (issue-tracking, Broken Link)
- cna@vuldb.com (issue-tracking, exploit, Issue Tracking)
- cna@vuldb.com (patch, Broken Link)
- cna@vuldb.com (Product, product)
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Frequently asked questions
- What is CVE-2025-3198?
- CVE-2025-3198 is a low-severity vulnerability in Gnu Binutils, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 3.3/10. Published 2025-04-04.
- How severe is CVE-2025-3198?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2025-3198 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.