CVE-2026-4647 Details
Description
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
A vulnerability has been identified in the GNU Binutils BFD library, which is commonly used for managing binary files like object files and executables. The flaw arises when the library processes specially crafted XCOFF object files. An improper validation of the relocation type value allows for out-of-bounds memory access, potentially leading to application crashes or unintended disclosure of memory contents. This vulnerability affects all versions of GNU Binutils prior to 2.47.
Users can upgrade to GNU Binutils version 2.47 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:33527 | [email protected] | |
| https://access.redhat.com/errata/RHSA-2026:39022 | [email protected] | |
| https://access.redhat.com/security/cve/CVE-2026-4647 | [email protected] | MitigationVendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450302 | [email protected] | Issue TrackingVendor Advisory |
| https://sourceware.org/bugzilla/show_bug.cgi?id=33919 | [email protected] | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gnu binutils | All versions |
CPE
Remediation
| |
| redhat openshift container platform | 4.0 |
CPE
Remediation
| |
| redhat enterprise linux | 6.0 7.0 8.0 9.0 10.0 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | CVE Modified | [email protected] |
| Aug 31, 2026 | CVE Modified | [email protected] |
| Aug 21, 2026 | CVE Modified | [email protected] |
| Jul 15, 2026 | CVE Modified | [email protected] |
| Jul 13, 2026 | CVE Modified | [email protected] |
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |