CVE-2017-9747

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.07.8High EPSS percentile95th7.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2017-06-19Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any systems use binutils 2.28, especially systems that run objdump -D on files from customers, suppliers, or downloads.
Obtain the vendor remediation from the linked advisory; no exact fixed binutils version is stated in the available findings.
Until updated, do not run objdump -D on untrusted binary files outside an isolated test environment.
Review crash reports and command logs for unexpected binutils failures while processing external files.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.

In plain language

Written by AI from the record

binutils 2.28 can crash when it examines a booby-trapped binary file, so businesses that inspect files from outside sources should address it.

A crafted binary can trigger a buffer overflow in binutils' BFD ieee_archive_p parsing path, causing a denial of service during operations such as objdump -D.

If you're affected

Analysis tool crashes
Interrupted build workflows
Untrusted-file inspection risk

What is it

This is a flaw in a tool used to inspect software files. A malicious file can make the tool fail when it tries to read it—like a deliberately malformed document that causes the office scanner to shut down instead of completing its check.

Who is affected

This matters to you if you use or run binutils 2.28, including on build, development, software-analysis, or automated file-processing systems. It is only a risk when binutils is made to examine a malicious binary file, particularly through objdump -D.

How urgent is it

A public exploit is available, so treat externally supplied binary files as unsafe until remediation is in place. This is an amber-priority issue: act promptly where affected systems inspect untrusted files, but it is not listed as actively exploited by CISA.

What to do — in detail

Confirm the installed release with objdump --version or your operating system's package inventory, and identify workflows that invoke objdump -D or otherwise parse externally supplied binaries. The available findings identify GNU Binutils 2.28 as affected, but do not provide a confirmed fixed version or branch-specific target; use the vendor remediation at https://sourceware.org/bugzilla/show_bug.cgi?id=21581 to select the supported update for your platform.

Test the vendor-provided update in build or analysis automation before rollout, as changing binutils releases can affect tool output and build integrations. If patching must wait, prevent untrusted files from reaching binutils or inspect them only in a disposable, isolated environment with restricted access to business systems. Monitor crash reporting, automated-job failures, and command auditing for objdump -D processing unexpected external files. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2017-9747 is rated CVSS 7.8 High (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-119. The issue is a buffer-overflow condition in ieee_archive_p in BFD's bfd/ieee.c, reachable when a crafted binary is processed, demonstrated with objdump -D; the documented outcome is application crash/denial of service, with other impact unspecified. One public exploit is known. EPSS estimates a 12.8% likelihood and is rising (96th percentile). CISA KEV does not list this CVE, so there is no confirmed KEV exploitation status or KEV due date.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

7.9% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band changemoderate → 0epss band change
2026-09-21EPSS band change0 → moderateepss band change
2026-09-06EPSS band changemoderate → 0epss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

gnuoss-project · USaka g. nu
- binutilsOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable