A missing bounds check in binutils' FR30 relocation handler lets a single crafted object file turn objdump -g into a one-shot exploit chain — defeating ASLR, PIE and modern heap hardening with no information leak. The Calif team's writeup walks through wrapping a 64-bit arelent offset, swapping endianness via a 2-byte partial overwrite of an xvec pointer, borrowing i386's partial_inplace relocation as an OOB increment, and finally pivoting to code execution through a House of Apple 2 FILE-struct hijack.