# CVE-2026-18220: GNU binutils out-of-bounds write in BFD DLX ELF backend

Source: https://junglewise.ai/threats/cve-2026-18220-gnu-binutils-out-of-bounds-write-in-bfd-dlx-elf-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-18220 · Severity: high · CVSS 7.8 · Published 2026-07-29

A vulnerability exists in GNU binutils, a collection of programming tools used to create and manage binary files. By tricking a user or automated system into processing a specially crafted file, an attacker could gain full control over the system. This poses a significant risk to developer workstations, automated security scanners, and software build pipelines that handle untrusted code.

Technologies: [Gnu Binutils](https://junglewise.ai/threats/technologies/binutils). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-18220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18220 being exploited in the wild.

**How severe is CVE-2026-18220?** High severity, with a CVSS score of 7.8, published 29 July 2026.

**Which products and versions are affected?** Gnu Binutils All versions built with DLX backend enabled.

**Is there a fix for CVE-2026-18220?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18220 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-18220?** Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the dlx_rtype_to_howto() function within bfd/elf32-dlx.c of the BFD library in GNU binutils. The flaw stems from inadequate bounds checking on attacker-controlled relocation type values (ELF32_R_TYPE) before they are used to index the dlx_elf_howto_table[] array. Because the DLX relocation type space is non-contiguous, the default switch case allows arbitrary indices to reach the array access. An attacker can exploit this via a specially crafted ELF/DLX object file to perform a File Stream Oriented Programming (FSOP) attack against glibc FILE structures, leading to arbitrary code execution. This is exploitable when binutils is compiled with the DLX backend enabled (e.g., --enable-targets=all).

## Affected products

- GNU binutils All versions built with DLX backend enabled
- Red Hat Red Hat Enterprise Linux 10 Affected (binutils package)

## Timeline

- 2026-07-27: disclosed: Reported via Red Hat Bugzilla
- 2026-07-29: advisory: Published by NVD and Red Hat

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-18220](https://access.redhat.com/security/cve/CVE-2026-18220)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2507670](https://bugzilla.redhat.com/show_bug.cgi?id=2507670)

## Related threats

- [GNU Binutils null pointer dereference in dynamic relocation allocation](https://junglewise.ai/threats/cve-2026-91782-gnu-binutils-null-pointer-dereference-in-dynamic-relocation)
- [GNU Binutils null pointer dereference in ELF section handler](https://junglewise.ai/threats/cve-2026-91781-gnu-binutils-null-pointer-dereference-in-elf-section-handler)
- [GNU Binutils null pointer dereference in ELF linker](https://junglewise.ai/threats/cve-2026-91780-gnu-binutils-null-pointer-dereference-in-elf-linker)
- [GNU Binutils null pointer dereference in eh_frame section offset](https://junglewise.ai/threats/cve-2026-91779-gnu-binutils-null-pointer-dereference-in-eh-frame-section-offset)
- [GNU Binutils memory corruption in ELF string table handling](https://junglewise.ai/threats/cve-2026-90831-gnu-binutils-memory-corruption-in-elf-string-table-handling)