CVE-2017-9955: The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distribu...

Security readout for executives and security teams

CVE-2017-9955 is a crash bug in GNU Binutils 2.28's BFD library. A specially crafted binary file can cause tools such as objdump to read past a heap buffer and terminate, creating denial-of-service risk where untrusted files are analyzed automatically. Exposure is most likely in build, malware-analysis, reverse-engineering, CI, or upload-processing workflows that invoke Binutils 2.28 or libbfd-based tooling on files supplied by external users or untrusted sources. Prioritize if the organization automatically analyzes external binaries, attachments, firmware, crash samples, or malware. Otherwise, this is a lower urgency maintenance item because the documented impact is application crash and the sources do not show active exploitation. Mitigation focus: Avoid processing untrusted binary files with Binutils 2.28 tools until vendor guidance is confirmed.; Update GNU Binutils or libbfd through vendor package channels when a fixed package is available.; Run objdump and BFD-based analysis services inside sandboxed, resource-limited environments..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.