CVE-2026-4647: Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
Other sources
An out-of-bounds read vulnerability in the BFD library of GNU Binutils affects the functions xcoffppcrelocatesection() and xcoff64ppcrelocatesection() in coff-rs6000.c and coff64-rs6000.c. The flaw is caused by improper validation of the relocation type field (rtype), which is read from input files and used as an array index without adequate bounds checking. This issue affects all versions of GNU Binutils prior to 2.47. When a specially crafted XCOFF object file is processed, this can lead to out-of-bounds memory access, potentially causing a crash, information disclosure, or unintended control flow behavior.
— Red Hat
Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.2-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.0-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.41-11 - Upgrade
Upgrade
GNU Binutilsto a version that resolves this vulnerability.Fixed in 2.47
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4647?
CVE-2026-4647 is classified as a high severity vulnerability due to its potential for out-of-bounds read exploitation in the GNU Binutils BFD library.
How do I fix CVE-2026-4647?
To fix CVE-2026-4647, users should upgrade the GNU Binutils BFD library to version 2.48 or later.
What causes the CVE-2026-4647 vulnerability?
CVE-2026-4647 is caused by improper handling of specially crafted XCOFF object files within the GNU Binutils BFD library.
Which software is affected by CVE-2026-4647?
The affected software for CVE-2026-4647 includes the GNU Binutils BFD library versions prior to 2.48.
What are the implications of CVE-2026-4647?
The implications of CVE-2026-4647 include potential system crashes or unauthorized data access due to the out-of-bounds read during processing of XCOFF files.