CVE-2026-19582: Binutils: stack buffer overflow in gnu binutils in rsrc_print_name from an untrusted pe file
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write.
Other sources
There's a flaw in binutils 2.46.1 in rsrcprintname() and rsrcparseentries() functions by which an attacker with local access or whom does not have local access but social engineers a victim to run binutils on a crafted PE file, can execute malicious code.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU binutilsto a version that resolves this vulnerability.Fixed in 2.46.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of GNU binutils 2.46.1 and earlier are exposed when they open a crafted PE file with binutils.
What does exploitation require?
An attacker must provide a crafted PE file and induce a victim to open it using binutils. The reported impact is arbitrary code execution through a stack buffer overflow out-of-bounds write.