PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4490 Gnu CVE debrief

CVE-2016-4490 is an integer overflow in cp-demangle.c within GNU libiberty. Per NVD, a crafted binary can trigger a segmentation fault and crash during demangling because of inconsistent use of long and int lengths. The issue was publicly discussed in an oss-security thread on 2016-05-05, while the CVE record itself was published by NVD on 2017-02-24 and later modified on 2026-05-13.

Vendor
Gnu
Product
CVE-2016-4490
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-24
Original CVE updated
2026-05-13
Advisory published
2017-02-24
Advisory updated
2026-05-13

Who should care

Maintainers and users of GNU libiberty-based tooling should review exposure, especially software that demangles or inspects untrusted binaries. Security teams should care if build, analysis, or reverse-engineering workflows may open attacker-supplied files.

Technical summary

NVD classifies the flaw as CWE-190 (Integer Overflow or Wraparound). The vulnerable component is cp-demangle.c in libiberty. A length-handling inconsistency between long and int can overflow during processing of crafted binary input, leading to a segmentation fault and denial of service. NVD’s CVSS v3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating availability impact only but with user interaction required.

Defensive priority

Medium. The issue is a crash/denial-of-service condition rather than code execution or data disclosure in the supplied record, but it affects parsing of attacker-controlled content.

Recommended defensive actions

  • Inventory GNU libiberty usage, including any bundled copies in toolchains or analysis utilities.
  • Check whether deployed builds include a fix or downstream backport for CVE-2016-4490.
  • Avoid processing untrusted binaries with affected versions until updated or isolated.
  • Add crash monitoring and input validation around demangling workflows.
  • Prefer patched packages from your distribution or vendor when available.

Evidence notes

The supplied NVD record identifies cpe:2.3:a:gnu:libiberty:*:*:*:*:*:*:*:* as vulnerable and lists CWE-190. The description states that integer overflow in cp-demangle.c can cause a segmentation fault and crash via a crafted binary. References in the corpus include the 2016 oss-security mailing list post, GCC Bug 70498, and a SecurityFocus bulletin entry. NVD’s CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Official resources

Public discussion appears in the cited oss-security mailing list post dated 2016-05-05. The CVE entry was published by NVD on 2017-02-24 and last modified on 2026-05-13.