Executive brief
A security vulnerability has been identified in GNU binutils, a collection of programming tools used for creating and managing binary programs. The flaw occurs when the linker tool processes a specially crafted XCOFF object file, which is a format used for executable files. If a user is tricked into processing a malicious file, an attacker could potentially execute unauthorized commands or cause the system to crash, impacting the reliability and security of development environments.
Technical details
A heap-based buffer overflow (CWE-122) exists in the BFD library of GNU binutils, specifically within the xcoff_link_add_symbols() function in bfd/xcofflink.c. The vulnerability is triggered during the linking of malformed XCOFF (Extended Common Object File Format) files where internal parsing logic (coff_set_alignment_hook) removes sections, causing the target_index to exceed the section_count. This leads to an out-of-bounds write of heap pointers into adjacent heap chunk metadata, followed by a free() call on attacker-influenced pointers. An attacker can exploit this two-phase heap corruption primitive to achieve arbitrary code execution or a denial of service (crash). The issue is fixed in binutils version 2.47.
Affected products
- GNU binutils <= 2.46
- Red Hat Enterprise Linux 6.0
- Red Hat Enterprise Linux 8.0
- Red Hat Enterprise Linux 9.0
- Red Hat Enterprise Linux 10.0
- Red Hat Openshift Container Platform 4.0
Timeline
- 2026-04-21: disclosed: Initial report in Red Hat Bugzilla
- 2026-04-22: advisory: CVE-2026-6846 assigned and published
- 2026-05-20: other: NVD initial analysis completed