Description
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
Affected products
gnu: binutils; redhat: openshift container platform; redhat: enterprise linux
References5
- access.redhat.com/security/cve/CVE-2026-4647 MitigationVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2450302 Issue TrackingVendor Advisory
- access.redhat.com/errata/RHSA-2026:33527
- access.redhat.com/errata/RHSA-2026:39022
- sourceware.org/bugzilla/show_bug.cgi?id=33919 Broken Link
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - EPSS — exploit probability
- 0% percentile: 7 · as of 12 November 2026
- CWE
- CWE-125
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.