CVE-2017-9746

This bug is like a “broken decoder” in the objdump program. If someone gives you a specially crafted file and you run objdump to inspect it, objdump can crash, which can stop your analysis work or automation. In the worst case, crashes like this sometimes become the first step in a deeper compromise—so it’s worth upgrading if you use this tool on untrusted files.

This matters if you use GNU Binutils’ objdump and specifically have version 2.28 installed. It’s most relevant when an operator (or automation) runs objdump -D on binaries that could be malicious—because the attacker needs you to execute the tool on their crafted file. This is not a “silently triggered in the background” issue; it requires user execution on an attacker-prepared input.

Treat this as AMBER: there is a known public exploit and the outcome can be a crash when processing malicious binaries. However, it’s local and requires a user to run objdump on a crafted file, so it’s not typically an internet-wide, drive-by risk for most small businesses. If your business analyzes or downloads untrusted binaries using Binutils 2.28, you should act promptly by upgrading.