VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 20, 2018· Updated Aug 5, 2024

CVE-2018-1000876

CVE-2018-1000876

Description

Integer overflow in binutils objdump can lead to heap overflow and arbitrary code execution via crafted files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in binutils objdump can lead to heap overflow and arbitrary code execution via crafted files.

Vulnerability

An integer overflow vulnerability exists in GNU binutils versions 2.32 and earlier, specifically in the bfd_get_dynamic_reloc_upper_bound and bfd_canonicalize_dynamic_reloc functions used by objdump. When processing a maliciously crafted binary file, an integer overflow can occur, leading to an undersized heap allocation and subsequent heap overflow. This affects binutils as shipped in Red Hat Enterprise Linux and Ubuntu systems prior to the fixes [1][2].

Exploitation

Exploitation requires an attacker to supply a specially crafted binary file that triggers the integer overflow when objdump processes its dynamic relocation entries. The attacker must have local access to the system and convince a user or automated process to run objdump on the malicious file. No authentication is needed beyond local user access, but user interaction is required to execute the tool on the crafted input.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running objdump. This can lead to a full compromise of the user's session, including data theft, privilege escalation (if the user has elevated rights), or further system compromise. The impact is limited to the privileges of the user who runs the tool.

Mitigation

The vulnerability is fixed in binutils after commit 3a551c7a1b80fca579461774860574eabfd7f18f. Red Hat released RHSA-2019:2075 [1] to address this issue. Ubuntu released USN-4336-1 [2] which updated binutils to version 2.30-21ubuntu1~18.04.3 for Ubuntu 18.04 LTS. Users should update their binutils package to the latest patched version. No workaround is available; updating is the recommended mitigation.

References
  1. https://access.redhat.com/errata/RHSA-2019:2075
  2. USN-4336-1: GNU binutils vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

56

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

6

News mentions

0

No linked articles in our index yet.