CVE-2017-9954: GNU Binutils

Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days.

The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.

Affected products

• GNU Binutils: version 2.28 only

Published 2017-06-26. Last modified 2026-06-17.