Is CVE-2026-15003 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15003 being exploited in the wild.

How severe is CVE-2026-15003?

Medium severity, with a CVSS score of 5.6, published 27 July 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 6 affected; Red Hat Enterprise Linux 7 affected.

Is there a fix for CVE-2026-15003?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15003 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-15003?

Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15003: GNU Binutils heap overflow in linker XCOFF processing

CVE-2026-15003 · Severity: medium · CVSS 5.6 · Published 2026-07-27

A security vulnerability has been identified in the GNU Binutils linker, a tool used by developers to combine computer code into executable programs. By tricking a user into processing a specially crafted 32-bit XCOFF object file, an attacker could cause the tool to crash or potentially access sensitive information stored in the system's memory. This could lead to a disruption of software development workflows or the unauthorized disclosure of internal data.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7. Vendors: Red Hat.

Quick answers

Is CVE-2026-15003 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15003 being exploited in the wild.
How severe is CVE-2026-15003?: Medium severity, with a CVSS score of 5.6, published 27 July 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 6 affected; Red Hat Enterprise Linux 7 affected.
Is there a fix for CVE-2026-15003?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15003 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-15003?: Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-buffer-overflow read (CWE-125) exists in the GNU Binutils linker component. The flaw is triggered when the linker attempts to process a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker with local access can exploit this by providing a malicious file for the linker to process, which requires user interaction (UI:R). Successful exploitation results in an out-of-bounds read, which can lead to a crash (Denial of Service) or the leakage of sensitive data from heap memory. The vulnerability is tracked upstream in sourceware bug 34053.

Affected products

GNU Binutils unspecified
Red Hat Enterprise Linux 10 affected
Red Hat Enterprise Linux 7 affected
Red Hat Enterprise Linux 6 affected

Timeline

2026-07-07: disclosed: Reported to Red Hat Bugzilla
2026-07-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.