CVE-2026-6846: GNU binutils heap buffer overflow in xcoff_link_add_symbols

CVE-2026-6846 · Severity: high · CVSS 7.8 · Published 2026-04-22

A security vulnerability has been identified in GNU binutils, a collection of programming tools used for creating and managing binary programs. The flaw occurs when the linker tool processes a specially crafted XCOFF object file, which is a format used for executable files. If a user is tricked into processing a malicious file, an attacker could potentially execute unauthorized commands or cause the system to crash, impacting the reliability and security of development environments.

Technologies: Red Hat Enterprise Linux 10.0, Red Hat Enterprise Linux 8.0, Red Hat Enterprise Linux 9.0, Red Hat OpenShift Container Platform 4.0. Vendors: Red Hat.

Quick answers

Is CVE-2026-6846 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6846 being exploited in the wild.
How severe is CVE-2026-6846?
High severity, with a CVSS score of 7.8, published 22 April 2026.
Which products and versions are affected?
GNU binutils <= 2.46; Red Hat Enterprise Linux 6.0; Red Hat Enterprise Linux 8.0; Red Hat Enterprise Linux 9.0; and 2 more.
Is there a fix for CVE-2026-6846?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6846 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-6846?
Check whether you run Red Hat Enterprise Linux 10.0, Red Hat Enterprise Linux 6.0, Red Hat Enterprise Linux 8.0 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the BFD library of GNU binutils, specifically within the xcoff_link_add_symbols() function in bfd/xcofflink.c. The vulnerability is triggered during the linking of malformed XCOFF (Extended Common Object File Format) files where internal parsing logic (coff_set_alignment_hook) removes sections, causing the target_index to exceed the section_count. This leads to an out-of-bounds write of heap pointers into adjacent heap chunk metadata, followed by a free() call on attacker-influenced pointers. An attacker can exploit this two-phase heap corruption primitive to achieve arbitrary code execution or a denial of service (crash). The issue is fixed in binutils version 2.47.

Affected products

  • GNU binutils <= 2.46
  • Red Hat Enterprise Linux 6.0
  • Red Hat Enterprise Linux 8.0
  • Red Hat Enterprise Linux 9.0
  • Red Hat Enterprise Linux 10.0
  • Red Hat Openshift Container Platform 4.0

Timeline

  • 2026-04-21: disclosed: Initial report in Red Hat Bugzilla
  • 2026-04-22: advisory: CVE-2026-6846 assigned and published
  • 2026-05-20: other: NVD initial analysis completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.