PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4490 Gnu CVE debrief

CVE-2016-4490 is an integer overflow in cp-demangle.c within GNU libiberty. Per NVD, a crafted binary can trigger a segmentation fault and crash during demangling because of inconsistent use of long and int lengths. The issue was publicly discussed in an oss-security thread on 2016-05-05, while the CVE record itself was published by NVD on 2017-02-24 and later modified on 2026-05-13.

Vendor
Gnu
Product
Libiberty
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-24
Original CVE updated
2026-05-13
Advisory published
2017-02-24
Advisory updated
2026-05-13

Who should care

Maintainers and users of GNU libiberty-based tooling should review exposure, especially software that demangles or inspects untrusted binaries. Security teams should care if build, analysis, or reverse-engineering workflows may open attacker-supplied files.

Technical summary

NVD classifies the flaw as CWE-190 (Integer Overflow or Wraparound). The vulnerable component is cp-demangle.c in libiberty. A length-handling inconsistency between long and int can overflow during processing of crafted binary input, leading to a segmentation fault and denial of service. NVD’s CVSS v3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating availability impact only but with user interaction required.

Defensive priority

Medium. The issue is a crash/denial-of-service condition rather than code execution or data disclosure in the supplied record, but it affects parsing of attacker-controlled content.

Recommended defensive actions

  • Inventory GNU libiberty usage, including any bundled copies in toolchains or analysis utilities.
  • Check whether deployed builds include a fix or downstream backport for CVE-2016-4490.
  • Avoid processing untrusted binaries with affected versions until updated or isolated.
  • Add crash monitoring and input validation around demangling workflows.
  • Prefer patched packages from your distribution or vendor when available.

Evidence notes

The supplied NVD record identifies cpe:2.3:a:gnu:libiberty:*:*:*:*:*:*:*:* as vulnerable and lists CWE-190. The description states that integer overflow in cp-demangle.c can cause a segmentation fault and crash via a crafted binary. References in the corpus include the 2016 oss-security mailing list post, GCC Bug 70498, and a SecurityFocus bulletin entry. NVD’s CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-4490 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-4490

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-4490 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4490

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.