CVE-2017-7226: gnu binutils Out-of-bounds Read
Vulnerability summary
CVE-2017-7226 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in gnu binutils. EPSS estimates a 2.49% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 22-03-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
2.49%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
+0.03 pp
From 2.46% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- binutils< 2.27.51.20161212-1
Gnu1 product
- binutils2.28
Ubuntu1 product
- binutilsAll versions (No fix recorded) | < 2.26.1-1ubuntu1~16.04.8+esm1
3 vendors · 3 products
