Memory Leak Vulnerability in Binutils Package - CVE-2018-20002

binutils Updated 02 Oct 2025

Summary

10/12/2018

Disclosed on

N/A

Severity

Yes i

Fix available

Medium

Severity

5.5

CVSS Score

ALPINE-CVE-2018-20002: The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service... Affects binutils versions < 2.32-r0. Fixed in 2.32-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Binutils package is a collection of binary tools used for handling object files, archives, and binary executables. It includes tools like 'as' (the assembler), 'ld' (the linker), and 'nm' (the symbol list generator). This package is essential for developers working with low-level programming and system software. However, it has been found to have a vulnerability that can lead to memory leaks when processing crafted ELF files.

Vulnerability Detail

The vulnerability, identified as CVE-2018-20002, originates from the _bfd_generic_read_minisymbols function in the Binary File Descriptor (BFD) library, which is part of the GNU Binutils. This function has a memory leak issue that can be exploited via a specially crafted ELF file, leading to denial of service due to excessive memory consumption. The vulnerability affects multiple versions of the Binutils package across various Alpine Linux releases, making it a significant concern for users relying on this package for their development needs.

How To Fix

Minimum fixed version

2.32-r0

This is the first release that contains the fix.

sudo apk add --upgrade binutils

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, users can avoid processing untrusted ELF files until the package is updated to the patched version. Additionally, monitoring memory usage during the execution of applications that utilize Binutils can help mitigate the impact of this vulnerability.

Conclusion

The CVE-2018-20002 vulnerability in the Binutils package poses a significant risk due to its potential for causing memory leaks and denial of service. Users are strongly advised to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.

See every vulnerability recorded for binutils →