CVE-2017-7302

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-29 · updated 2026-06-17
Weakness: CWE-125

Description

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.

Affected products

GNU Binutils: 2.28

References

http://www.securityfocus.com/bid/97216
https://sourceware.org/bugzilla/show_bug.cgi?id=20921
http://www.securityfocus.com/bid/97216
https://sourceware.org/bugzilla/show_bug.cgi?id=20921

Get alerted when CVE-2017-7302 or the next vulnerability affects your stack