CVE-2026-4647
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in the BFD library of GNU Binutils fails to validate relocation type values in crafted XCOFF files, leading to out-of-bounds memory reads. This can cause tool crashes or memory content disclosure.
Risk Assessment
The risk includes denial-of-service due to crashes and limited information disclosure, potentially exposing sensitive data from memory.
Recommendation
Update GNU Binutils to a patched version immediately and avoid processing untrusted XCOFF files until the fix is applied.
Other vulnerabilities in GNU Binutils
See all- CVE-2017-17126High
The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.
- CVE-2017-17125High
GNU Binutils 2.29.1 has a mishandling issue with certain global symbols in nm.c and objdump.c, which can lead to application crashes or denial of service.
- CVE-2017-17124High
The _bfd_coff_read_string_table function in the BFD library (libbfd) in GNU Binutils 2.29.1 does not properly validate the size of the external string table, which can lead to denial of service or buffer overflow.
- CVE-2017-17122High
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which can lead to denial of service or heap-based buffer overflow.
- CVE-2017-17121High
The Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.
- CVE-2017-16832High
The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not validate size and offset values in the data dictionary, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.
- CVE-2017-16830High
The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 lacks integer-overflow protection on 32-bit platforms, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.
- CVE-2017-16829High
The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not prevent negative pointers, which may lead to application crashes or other unspecified impacts via a crafted ELF file.
- CVE-2017-16828High
The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service through integer overflow and heap-based buffer over-read, potentially leading to application crashes.
- CVE-2017-16827High
The aout_get_external_symbols function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service via a crafted ELF file, potentially leading to application crashes.
Original NVD description (English source)
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.