What is CVE-2018-1000876?

CVE-2018-1000876 is a high-severity vulnerability in GNU Binutils, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2018-12-20.

How severe is CVE-2018-1000876?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2018-1000876 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in GNU Binutils

CVE-2018-1000876

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

Vulnerability class: Integer Overflow

Published 2018-12-20 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (50.2th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: -0.000

Affected products

GNU Binutils
Canonical Ubuntu Linux — versions 18.04
Red Hat Enterprise Linux Desktop — versions 7.0
Red Hat Enterprise Linux Server — versions 7.0
Red Hat Enterprise Linux Workstation — versions 7.0

Weakness classification (CWE)

Public proof-of-concept exploits

phonito/phonito-vulnerable-container

References

sourceware.org/git/gitweb.cgi
www.securityfocus.com/bid/106304 (vdb-entry, Broken Link)
sourceware.org/bugzilla/show_bug.cgi (Exploit, Third Party Advisory, Issue Tracking)
access.redhat.com/errata/RHSA-2019:2075 (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html (vendor-advisory, Broken Link)
lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html (vendor-advisory, Broken Link)
usn.ubuntu.com/4336-1/ (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2018-1000876?: CVE-2018-1000876 is a high-severity vulnerability in GNU Binutils, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2018-12-20.
How severe is CVE-2018-1000876?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2018-1000876 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.