CVE-2017-8421: GNU Binutils

Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days.

The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.

Affected products

• GNU Binutils: version 2.28 only

Published 2017-05-02. Last modified 2026-06-17.