CVE-2026-6846: Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable.
Other sources
Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
— Microsoft
Heap-buffer-overflow WRITE in xcofflinkaddsymbols() in bfd/xcofflink.c. Triggered by malformed XCOFF object file during linking. Fixed upstream by Alan Modra.
Public reference: https://sourceware.org/bugzilla/showbug.cgi?id=34049 Affects binutils <= 2.46.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.41-12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.2-8 - Upgrade
Upgrade
binutilsto a version that resolves this vulnerability.Fixed in 2.46
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6846?
CVE-2026-6846 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-6846?
To mitigate CVE-2026-6846, users should upgrade to a version of GNU binutils that is higher than 2.46.
Who is affected by CVE-2026-6846?
CVE-2026-6846 affects users of GNU binutils versions up to and including 2.46.
What type of vulnerability is CVE-2026-6846?
CVE-2026-6846 is a heap-buffer-overflow vulnerability that occurs when processing malformed XCOFF object files.
Can CVE-2026-6846 be exploited remotely?
CVE-2026-6846 requires local access for exploitation, as it involves processing specific object files.