PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6131 Gnu CVE debrief

CVE-2016-6131 is a denial-of-service vulnerability in GNU Libiberty’s demangler. A crafted cyclic reference in remembered mangled types can drive the demangler into an infinite loop, stack overflow, or crash. The issue is classified as HIGH severity (CVSS 7.5) because it is network-reachable in the general case, requires no privileges or user interaction, and impacts availability.

Vendor
Gnu
Product
Libiberty
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-07
Original CVE updated
2026-05-13
Advisory published
2017-02-07
Advisory updated
2026-05-13

Who should care

Administrators and developers who ship or embed GNU Libiberty, especially any software that demangles untrusted input, parses symbol names, or exposes demangling through a service, debugger, or analysis pipeline.

Technical summary

The vulnerability is an input-validation problem in the GNU Libiberty demangler. When it encounters a cycle in remembered mangled type references, the parser can recurse or iterate indefinitely instead of rejecting the malformed structure, leading to infinite loop behavior, stack exhaustion, or process crash. NVD maps the weakness to CWE-20 and lists the affected CPE as gnu:libiberty.

Defensive priority

High. Availability impact is direct and the attack surface can include remotely supplied input if demangling is exposed in a service or automated processing path.

Recommended defensive actions

  • Apply the GNU upstream fix referenced in the GCC patch mailing-list advisory and backport/vendor updates as needed.
  • Inventory any products or services that embed GNU Libiberty or call its demangler on external input.
  • Restrict or sandbox demangling of untrusted data where possible, especially in network-facing or batch-processing systems.
  • Add crash monitoring and alerting for components that invoke the demangler so malformed-input failures are detected quickly.
  • If you cannot patch immediately, validate or isolate incoming symbol/type data before handing it to demangling code.

Evidence notes

The official CVE/NVD record identifies GNU Libiberty as vulnerable and describes denial-of-service via cyclic remembered mangled types. The NVD record shows the issue as published on 2017-02-07 and modified on 2026-05-13; the referenced upstream mailing-list, bug tracker, and patch links are dated 2016-06-30, indicating earlier disclosure and fix activity. The NVD vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the primary weakness is CWE-20.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6131 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6131

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6131 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6131

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.