CVE-2025-15504 – A null pointer dereference vulnerability exists... (How to Fix)

Q: What is the severity of CVE-2025-15504?

CVE-2025-15504 has a CVSS score of 3.3 (LOW). A null pointer dereference vulnerability exists in LIEF's ELF binary parser that can cause denial of service when processing malicious ELF files. This affects LIEF versions up to 0.17.1. The vulnerability requires local access to trigger and could crash applications using the vulnerable library.

📋 TL;DR

A null pointer dereference vulnerability exists in LIEF's ELF binary parser that can cause denial of service when processing malicious ELF files. This affects LIEF versions up to 0.17.1. The vulnerability requires local access to trigger and could crash applications using the vulnerable library.

💻 Affected Systems

Products:

lief-project LIEF

Versions: up to and including 0.17.1

Operating Systems: All platforms running LIEF

Default Config Vulnerable: ⚠️ Yes

Notes: Any application or service using LIEF's ELF parsing functionality is vulnerable when processing untrusted ELF files

📦 What is this software?

Lief by Lief Project

View all CVEs affecting Lief →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Application crash leading to denial of service for any service or tool using LIEF to parse ELF files

🟠

Likely Case

Local denial of service through crafted ELF files causing parser crashes

🟢

If Mitigated

Minimal impact if proper input validation and sandboxing are implemented

🌐 Internet-Facing: LOW - requires local access to trigger

🏢 Internal Only: MEDIUM - internal users could crash services using LIEF

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit code is publicly available on GitHub, requires local access to trigger

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.17.2

Vendor Advisory: https://github.com/lief-project/LIEF/releases/tag/0.17.2

Restart Required: Yes

Instructions:

1. Check current LIEF version
2. Upgrade to version 0.17.2 or later using package manager
3. Restart any services using LIEF
4. Recompile any applications statically linked to LIEF

🔧 Temporary Workarounds

Input validation

all

Implement strict input validation for ELF files before passing to LIEF parser

Sandbox parsing

all

Run LIEF parsing operations in isolated containers or sandboxes

🧯 If You Can't Patch

Restrict local access to systems running vulnerable LIEF versions
Implement monitoring for abnormal process crashes related to ELF parsing

🔍 How to Verify

Check if Vulnerable:

Check LIEF version with 'python -c "import lief; print(lief.__version__)"' or check package manager

Check Version:

python -c "import lief; print(lief.__version__)"

Verify Fix Applied:

Verify version is 0.17.2 or higher and test with known malicious ELF files

📡 Detection & Monitoring

Log Indicators:

Segmentation fault logs from processes using LIEF
Abnormal process termination during ELF file processing

Network Indicators:

None - local vulnerability only

SIEM Query:

Process termination events with exit code 139 (SIGSEGV) from applications known to use LIEF

📊 Metadata

CVE ID: CVE-2025-15504

CVSS v3 Score: 3.3 (LOW)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-404

EPSS Score: 0.01% exploit probability (0.7th percentile)

Published: January 10, 2026

Last Updated: February 23, 2026

🔗 References

https://github.com/lief-project/LIEF/
https://github.com/lief-project/LIEF/commit/81bd5d7ea0c390563f1c4c017c9019d154802978 Patch
https://github.com/lief-project/LIEF/issues/1277 Exploit,Issue Tracking,Patch
https://github.com/lief-project/LIEF/issues/1277#issuecomment-3693859001 Exploit,Issue Tracking,Patch
https://github.com/lief-project/LIEF/releases/tag/0.17.2 Release Notes
https://github.com/oneafter/1210/blob/main/segv1 Product
https://vuldb.com/?ctiid.340375 Permissions Required,VDB Entry
https://vuldb.com/?id.340375 Third Party Advisory,VDB Entry
https://vuldb.com/?submit.733329 Exploit,Third Party Advisory,VDB Entry
https://github.com/lief-project/LIEF/issues/1277 Exploit,Issue Tracking,Patch
https://github.com/lief-project/LIEF/issues/1277#issuecomment-3693859001 Exploit,Issue Tracking,Patch
https://vuldb.com/?submit.733329 Exploit,Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-15504, you might also want to check these: