CVE-2018-20712

A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.

• CWE-125

• http://www.securityfocus.com/bid/106563Third Party Advisory, VDB Entry
• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629Exploit, Issue Tracking, Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=24043Exploit, Issue Tracking, Third Party Advisory
• https://support.f5.com/csp/article/K38336243Third Party Advisory
• http://www.securityfocus.com/bid/106563Third Party Advisory, VDB Entry
• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629Exploit, Issue Tracking, Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=24043Exploit, Issue Tracking, Third Party Advisory
• https://support.f5.com/csp/article/K38336243Third Party Advisory

Published

Jan 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20698The floragunn Search Guard plugin before 6.x-16 for Kibana a…
• CVE-2018-20699Docker Engine before 18.09 allows attackers to cause a denia…
• CVE-2018-2070Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20703CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query …
• CVE-2018-2071Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20710Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-20713Shopware before 5.4.3 allows SQL Injection by remote authent…
• CVE-2018-20714The logging system of the Automattic WooCommerce plugin befo…
• CVE-2018-20715The DB abstraction layer of OXID eSales 4.10.6 is vulnerable…
• CVE-2018-20716CubeCart before 6.1.13 has SQL Injection via the validate[] …
• CVE-2018-20717In the orders section of PrestaShop before 1.7.2.5, an attac…
• CVE-2018-20718In Pydio before 8.2.2, an attack is possible via PHP Object …