An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32.

Published 7 y ago 2019-06-26 · modified 29 d ago 2026-10-08 · JSON

CVSS

5.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

1.8%

percentile 79%

Public exploits

none known

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 29 d ago 2026-10-08

Exploit prediction (EPSS)

1.80% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:N/A:P`

Classification

Weakness

CWE-125 Out-of-bounds Read

References

sourceware.org /bugzilla/show_bug.cgi?id=24689 · x_refsource_MISC, x_transferred
sourceware.org /git/gitweb.cgi?p=binutils-gdb.git%3Bh=890f750a3b053532a4b839a2dd6243076de12031 · x_refsource_MISC, x_transferred
securityfocus.com /bid/108903 · vdb-entry, x_refsource_BID, x_transferred
usn.ubuntu.com /4336-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
security.gentoo.org /glsa/202007-39 · vendor-advisory, x_refsource_GENTOO, x_transferred
lists.opensuse.org /opensuse-security-announce/2020-10/msg00078.html · vendor-advisory, x_refsource_SUSE, x_transferred
lists.opensuse.org /opensuse-security-announce/2020-11/msg00004.html · vendor-advisory, x_refsource_SUSE, x_transferred

Sources

CVE List: CVE-2019-12972
NVD: CVE-2019-12972

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.