CVE-2017-9756: The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers...

Security readout for executives and security teams

CVE-2017-9756 is a crash risk in GNU Binutils 2.28 when objdump processes a specially crafted AArch64 binary. It mainly threatens systems that analyze untrusted binaries, such as build, malware-analysis, forensics, or CI environments, rather than typical end-user browsing or server traffic. Exposure is most likely where GNU Binutils 2.28, especially objdump, processes untrusted or attacker-supplied binaries. Internet-facing exposure is indirect unless a service automatically disassembles uploaded files. Treat this as a targeted operational risk for engineering and analysis environments. Prioritize patching if your organization processes external binaries, malware samples, firmware, customer uploads, or CI artifacts with Binutils tooling. Mitigation focus: Identify systems and containers running GNU Binutils 2.28.; Upgrade Binutils using vendor-supported packages or advisory guidance.; Restrict objdump use on untrusted binaries until patched..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.