Gnu Binutils vulnerabilities

CVE-2017-6969 [CRITICAL] CWE-125 CVE-2017-6969: readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.

CVE-2025-7546 [HIGH] CWE-119 CVE-2025-7546: A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of

CVE-2018-12699 [CRITICAL] CWE-787 CVE-2018-12699: finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-base finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.

CVE-2024-53589 [HIGH] CVE-2024-53589: GNU objdump 2 GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.

CVE-2025-1179 [HIGH] CWE-119 CVE-2025-1179: A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issu A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit

CVE-2025-5245 [HIGH] CWE-119 CVE-2025-5245: A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the f A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended

CVE-2025-69650 [HIGH] CWE-415 CVE-2025-69650: GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF bi GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), lead

CVE-2017-7226 [CRITICAL] CWE-125 CVE-2017-7226: The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distribute The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to informat

CVE-2017-7614 [CRITICAL] CWE-476 CVE-2017-7614: elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2 elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.

CVE-2018-12698 [HIGH] CVE-2018-12698: demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attac demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.

CVE-2014-8504 [HIGH] CWE-119 CVE-2014-8504: Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.

CVE-2014-8503 [HIGH] CWE-119 CVE-2014-8503: Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

CVE-2019-1010180 [HIGH] CVE-2019-1010180: GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.

CVE-2026-6846 [HIGH] CWE-122 CVE-2026-6846: A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a speciall A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or

CVE-2020-35342 [HIGH] CWE-665 CVE-2020-35342: GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.

CVE-2025-69649 [HIGH] CWE-476 CVE-2025-69649: GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a c GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corrupti

CVE-2021-3530 [HIGH] CWE-674 CVE-2021-3530: A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.

CVE-2018-1000876 [HIGH] CWE-190 CVE-2018-1000876: binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dyna binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears t

CVE-2014-8502 [HIGH] CWE-119 CVE-2014-8502: Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

CVE-2016-6131 [HIGH] CVE-2016-6131: The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the refe The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types.