CVE-2017-9954: The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed...

Security readout for executives and security teams

CVE-2017-9954 is a denial-of-service flaw in GNU Binutils libbfd 2.28. A specially crafted Tektronix HEX file can crash tools that parse it, such as nm. The main business risk is disruption of analysis, build, or file-processing systems that accept untrusted binary/object files. Exposure is most likely where Binutils/libbfd 2.28 tools process untrusted tekhex files, including build pipelines, malware analysis systems, reverse-engineering workstations, and upload scanners using BFD-backed utilities. Schedule remediation in normal vulnerability maintenance unless affected systems automatically process untrusted files. Prioritize isolated analysis pipelines and CI systems where crashes could interrupt operations. Mitigation focus: Identify systems using GNU Binutils or libbfd 2.28.; Apply vendor-supported Binutils updates or distribution security fixes.; Restrict untrusted tekhex file processing where possible..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.