CVE-2026-4647 Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
Attackers can cause crashes or leak memory by providing crafted XCOFF files to tools using the GNU Binutils BFD library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-4647?
CVE-2026-4647 is a medium-severity vulnerability in Gnu Binutils, published on 23 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
Weakness: CWE-125
Which versions are affected by CVE-2026-4647?
It affects 3 products.
Products include Gnu Binutils, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2026-4647?
Apply the vendor's patch.
Is CVE-2026-4647 being exploited?
There is no known exploitation of CVE-2026-4647 in the wild and no public exploit code.
Other vulnerabilities in Gnu Binutils
Sources
Also known as AZL-80877, AZL-80895, AZL-80904, DEBIAN-CVE-2026-4647, ECHO-6de7-bed5-044a, GHSA-v858-p3pc-hqjh and 2 more.