TI-2025-14143 Aliases CVE-2025-15504 GHSA-mjjp-xjfg-97wg

lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereference

MEDIUM 55CWE-404Published 2026-01-10 · Updated 2026-02-23

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-404.

Summary

A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parse_binary of the file src/ELF/Parser.tcc of the component ELF Binary Parser. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.17.2 can resolve this issue. The patch is identified as 81bd5d7ea0c390563f1c4c017c9019d154802978. It is recommended to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00265 18th percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD and the CNA

Fix Fixed LIEF (lief-project): 0.17.2lief (PyPI): 0.17.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lief-project	LIEF	0.17.0; 0.17.1	0.17.2	Patch available	CNA
—	lief (PyPI)	before 0.17.2	0.17.2	Patch available	GHSA-mjjp-xjfg-97wg
—	lief (crates.io)	before 0.17.2	0.17.2	Patch available	GHSA-mjjp-xjfg-97wg

LIEF Vendorlief-project Affected 0.17.0; 0.17.1 Fixed in 0.17.2 Patch available CNA
lief (PyPI) Vendor— Affected before 0.17.2 Fixed in 0.17.2 Patch available GHSA-mjjp-xjfg-97wg
lief (crates.io) Vendor— Affected before 0.17.2 Fixed in 0.17.2 Patch available GHSA-mjjp-xjfg-97wg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lief-project:lief::::::::	before 0.17.2	Vulnerable	lief-project

cpe:2.3:a:lief-project:lief:*:*:*:*:*:*:*:* Versions before 0.17.2 Vulnerable ·lief-project

Remediation

Fix · CNA LIEF (lief-project) Fixed in 0.17.2
Fix · GHSA-mjjp-xjfg-97wg lief (PyPI) Fixed in 0.17.2 Advisory →
Fix · GHSA-mjjp-xjfg-97wg lief (crates.io) Fixed in 0.17.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-15504
2026-10-03 Alias added: GHSA-mjjp-xjfg-97wg

References

Exploit 3

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-15504

Other 2

TI-2022-21067 A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind… CVSS 3.1MEDIUM 6.5
TI-2024-20899 An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the… CVSS 3.1LOW 3.9
TI-2021-12110 An issue was discovered in LIEF through 0.11.4. CVSS 3.1HIGH 8.8
TI-2022-18111 LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c. CVSS 3.1HIGH 7.8
TI-2022-17963 LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc. CVSS 3.1HIGH 7.8
TI-2022-19480 A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF… CVSS 3.1MEDIUM 6.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences