CVE-2018-9996: An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30.

Security readout for executives and security teams

CVE-2018-9996 is a denial-of-service issue in GNU libiberty as shipped with GNU Binutils 2.30. A malformed or deeply nested C++ symbol name can exhaust stack space during demangling, crashing the affected process rather than enabling confirmed code execution. Exposure is most likely where GNU Binutils 2.30 or libiberty demangling handles untrusted symbols, binaries, object files, crash reports, or build artifacts. The source bundle does not identify downstream distributions or embedded copies. Prioritize as moderate where untrusted binary analysis is automated or customer-facing. For ordinary developer workstations, handle through normal package updates unless local exposure is unusually high. Mitigation focus: Inventory GNU Binutils and libiberty versions in developer and analysis environments.; Check GNU, OS distribution, and package maintainer guidance for fixed builds.; Upgrade away from affected GNU Binutils 2.30 builds where vendor updates exist..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.