PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6131 Gnu CVE debrief

CVE-2016-6131 is a denial-of-service vulnerability in GNU Libiberty’s demangler. A crafted cyclic reference in remembered mangled types can drive the demangler into an infinite loop, stack overflow, or crash. The issue is classified as HIGH severity (CVSS 7.5) because it is network-reachable in the general case, requires no privileges or user interaction, and impacts availability.

Vendor
Gnu
Product
CVE-2016-6131
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-07
Original CVE updated
2026-05-13
Advisory published
2017-02-07
Advisory updated
2026-05-13

Who should care

Administrators and developers who ship or embed GNU Libiberty, especially any software that demangles untrusted input, parses symbol names, or exposes demangling through a service, debugger, or analysis pipeline.

Technical summary

The vulnerability is an input-validation problem in the GNU Libiberty demangler. When it encounters a cycle in remembered mangled type references, the parser can recurse or iterate indefinitely instead of rejecting the malformed structure, leading to infinite loop behavior, stack exhaustion, or process crash. NVD maps the weakness to CWE-20 and lists the affected CPE as gnu:libiberty.

Defensive priority

High. Availability impact is direct and the attack surface can include remotely supplied input if demangling is exposed in a service or automated processing path.

Recommended defensive actions

  • Apply the GNU upstream fix referenced in the GCC patch mailing-list advisory and backport/vendor updates as needed.
  • Inventory any products or services that embed GNU Libiberty or call its demangler on external input.
  • Restrict or sandbox demangling of untrusted data where possible, especially in network-facing or batch-processing systems.
  • Add crash monitoring and alerting for components that invoke the demangler so malformed-input failures are detected quickly.
  • If you cannot patch immediately, validate or isolate incoming symbol/type data before handing it to demangling code.

Evidence notes

The official CVE/NVD record identifies GNU Libiberty as vulnerable and describes denial-of-service via cyclic remembered mangled types. The NVD record shows the issue as published on 2017-02-07 and modified on 2026-05-13; the referenced upstream mailing-list, bug tracker, and patch links are dated 2016-06-30, indicating earlier disclosure and fix activity. The NVD vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the primary weakness is CWE-20.

Official resources

Public references in the supplied corpus point to upstream mailing-list discussion, issue tracking, and patch activity dated 2016-06-30. The CVE record was published on 2017-02-07; the NVD entry was later modified on 2026-05-13.