# CVE-2026-4647: GNU Binutils BFD library out-of-bounds read in XCOFF relocation processing

Source: https://junglewise.ai/threats/cve-2026-4647-gnu-binutils-bfd-library-out-of-bounds-read-in-xcoff-relocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-23. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4647 · Severity: medium · CVSS 6.1 · Published 2026-03-23

A vulnerability exists in the GNU Binutils BFD library, a fundamental component used by developers and system administrators to manage and process binary files like programs and libraries. By tricking a user into opening a specially crafted XCOFF object file with an affected tool (such as a linker or debugger), an attacker can cause the application to crash or potentially reveal sensitive information from the system's memory. This could disrupt development workflows or lead to limited data exposure on affected Linux systems.

Technologies: [Gnu Binutils](https://junglewise.ai/threats/technologies/binutils). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-4647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4647 being exploited in the wild.

**How severe is CVE-2026-4647?** Medium severity, with a CVSS score of 6.1, published 23 March 2026.

**Which products and versions are affected?** Gnu Binutils All versions prior to 2.47.

**Is there a fix for CVE-2026-4647?** A patch was published on 2026-03-15: Fix committed to GNU Binutils master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4647 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-4647?** Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds (OOB) read vulnerability exists in the BFD library of GNU Binutils within the xcoff_ppc_relocate_section() and xcoff64_ppc_relocate_section() functions in coff-rs6000.c and coff64-rs6000.c. The flaw is caused by improper validation of the relocation type field (r_type) read from XCOFF input files; this 8-bit value is used as an array index into howto tables (e.g., xcoff64_howto_table) before bounds checking occurs. An attacker can provide a crafted XCOFF file that triggers an OOB read, leading to a crash (DoS), information disclosure, or potentially unintended control flow if corrupted data is subsequently used as a function pointer. The issue is fixed in GNU Binutils version 2.47.

## Affected products

- GNU Binutils All versions prior to 2.47
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 6

## Timeline

- 2026-02-23: disclosed: Initial report on Sourceware Bugzilla
- 2026-03-15: patched: Fix committed to GNU Binutils master branch
- 2026-03-23: advisory: CVE published and Red Hat advisory issued

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-4647](https://access.redhat.com/security/cve/CVE-2026-4647)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2450302](https://bugzilla.redhat.com/show_bug.cgi?id=2450302)
- [https://sourceware.org/bugzilla/show_bug.cgi?id=33919](https://sourceware.org/bugzilla/show_bug.cgi?id=33919)

## Related threats

- [GNU Binutils null pointer dereference in dynamic relocation allocation](https://junglewise.ai/threats/cve-2026-91782-gnu-binutils-null-pointer-dereference-in-dynamic-relocation)
- [GNU Binutils null pointer dereference in ELF section handler](https://junglewise.ai/threats/cve-2026-91781-gnu-binutils-null-pointer-dereference-in-elf-section-handler)
- [GNU Binutils null pointer dereference in ELF linker](https://junglewise.ai/threats/cve-2026-91780-gnu-binutils-null-pointer-dereference-in-elf-linker)
- [GNU Binutils null pointer dereference in eh_frame section offset](https://junglewise.ai/threats/cve-2026-91779-gnu-binutils-null-pointer-dereference-in-eh-frame-section-offset)
- [GNU Binutils memory corruption in ELF string table handling](https://junglewise.ai/threats/cve-2026-90831-gnu-binutils-memory-corruption-in-elf-string-table-handling)