Executive brief
A security vulnerability has been identified in the GNU Binutils linker, a tool used by developers to combine computer code into executable programs. By tricking a user into processing a specially crafted 32-bit XCOFF object file, an attacker could cause the tool to crash or potentially access sensitive information stored in the system's memory. This could lead to a disruption of software development workflows or the unauthorized disclosure of internal data.
Technical details
A heap-buffer-overflow read (CWE-125) exists in the GNU Binutils linker component. The flaw is triggered when the linker attempts to process a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker with local access can exploit this by providing a malicious file for the linker to process, which requires user interaction (UI:R). Successful exploitation results in an out-of-bounds read, which can lead to a crash (Denial of Service) or the leakage of sensitive data from heap memory. The vulnerability is tracked upstream in sourceware bug 34053.
Affected products
- GNU Binutils unspecified
- Red Hat Enterprise Linux 10 affected
- Red Hat Enterprise Linux 7 affected
- Red Hat Enterprise Linux 6 affected
Timeline
- 2026-07-07: disclosed: Reported to Red Hat Bugzilla
- 2026-07-27: advisory: NVD publication date