CVE-2017-16831

7.8 highEPSS 1.8%

High (7.8) in gnu binutils. EPSS 1.8% chance of exploitation in the next 30 days.

coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2017-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gnu:binutils

References

https://security.gentoo.org/glsa/201811-17
https://sourceware.org/bugzilla/show_bug.cgi?id=22385
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=6cee897971d4d7cd37d2a686bb6d2aa3e759c8ca
https://security.gentoo.org/glsa/201811-17
https://sourceware.org/bugzilla/show_bug.cgi?id=22385

Check your stack JSON