CVE-2018-18700: gnu binutils Infinite Loop

Vulnerability summary

CVE-2018-18700 is a medium (CVSS 5.5) Infinite Loop vulnerability in gnu binutils. EPSS estimates a 1.69% chance of exploitation in the next 30 days, higher than 76.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-10-2018
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.