A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-binutilsalpine-linux-upgrade-binutils-avr | Aug 22, 2024 | Jan 15, 2019 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 15, 2019 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Jan 15, 2019 | |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Jan 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub