LiveActive security incident?Get immediate response
CVE Record

CVE-2018-9138: An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30.

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_nested_args, demangle_args, do_arg, and do_type.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2018-9138 is a stack-exhaustion flaw in GNU libiberty’s C++ demangling code, distributed with GNU Binutils 2.29 and 2.30. It can cause a process using the demangler to crash or fail when handling problematic C++ symbol data. The provided sources do not report active exploitation.

Executive priority

Prioritize remediation for build, malware-analysis, crash-processing, or file-inspection systems that handle untrusted binaries. For ordinary endpoints with vendor-maintained packages, treat this as routine security maintenance unless local workflows expose demangling to untrusted inputs.

Technical view

The issue is in cplus-dem.c recursive demangling paths: demangle_nested_args, demangle_args, do_arg, and do_type. Excessive recursion can exhaust stack space. The source bundle identifies GNU Binutils 2.29 and 2.30 distribution context, but does not provide CVSS, CWE, or fixed upstream version details.

Likely exposure

Exposure is most likely where GNU Binutils/libiberty 2.29 or 2.30, or distro packages derived from them, process untrusted or externally supplied C++ symbols. Build systems, analysis pipelines, and developer workstations may be more relevant than internet-facing services.

Exploitation context

No KEV listing is provided, and the supplied sources do not state active exploitation. The practical risk appears to be denial of service against tools or services that invoke C++ demangling on crafted inputs, not direct remote system compromise based on the bundle.

Researcher notes

Evidence is limited: no CVSS, CWE, affected CPE list, exploit status, or exact fix commit is included in the bundle. The safest conclusion is a stack-exhaustion denial-of-service condition in libiberty C++ demangling, with vendor advisories available for Ubuntu packages.

Mitigation direction

  • Inventory GNU Binutils and libiberty package versions across build and analysis systems.
  • Apply applicable vendor updates, including relevant Ubuntu advisories where those packages are used.
  • Check upstream GNU Binutils guidance for fixed versions if managing source-built installations.
  • Restrict automated demangling of untrusted files where updates cannot be applied promptly.

Validation and detection

  • Confirm whether GNU Binutils 2.29 or 2.30 is installed or embedded.
  • Review distro security advisory status for deployed binutils/libiberty packages.
  • Identify services or workflows that demangle externally supplied C++ symbols.
  • Verify patched package installation through asset and package-management records.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-9138 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.