CVE-2025-3198

GNU Binutils objdump bucomm.c display_info memory leak

State: Published
Severity: 4.8 Medium
Published: Apr 4, 2025
Updated: Oct 15, 2026
Reserved: Apr 3, 2025

Description

A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P	VulDB

Weaknesses

CWE-401 Memory Leak
CWE-404 Denial of Service

Affected Products

Product	Versions
BinutilsGNU	2.43Affected 2.44Affected

References

VDB-303151 | GNU Binutils objdump bucomm.c display_info memory leakvdb-entrytechnical-description
VDB-303151 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #545773 | GNU Library Objdump in Binutil 2.44 and 2.43 (also other possible downward versions) Memory Leakthird-party-advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=32716issue-tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=32716#c0exploitissue-tracking
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344dpatch
https://www.gnu.org/product
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.