CVE-2017-14933: read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed...

Security readout for executives and security teams

This flaw lets a specially crafted ELF binary make GNU Binutils libbfd loop indefinitely while reading DWARF debug data. The business impact is denial of service against systems or workflows that inspect untrusted binaries, such as malware analysis, CI, packaging, or security scanning. The sources do not show code execution or confirmed active exploitation. Exposure is most likely where Binutils 2.29 or libbfd-based tools process ELF files supplied by users, partners, CI jobs, malware feeds, or uploaded artifacts. General desktop or server exposure is lower unless untrusted binaries are automatically analyzed. Prioritize remediation for internet-facing upload pipelines, shared CI, malware analysis, and package-processing systems. Lower priority is reasonable for systems that do not parse untrusted ELF files. Treat it as availability risk, not proven compromise risk. Mitigation focus: Inventory systems using GNU Binutils 2.29 or libbfd consumers.; Apply vendor or distribution fixes referencing the Sourceware commits and Gentoo advisory.; Avoid processing untrusted ELF files on shared production hosts..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.