CVE-2026-19582
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could...
Red Hat Product Security has come to the conclusion that this CVE is false due to upstream security policy.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-rpcr-vf2r-fmwr
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could...
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write.
- Record
GHSA-rpcr-vf2r-fmwr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Red Hat Product Security has come to the conclusion that this CVE is false due to upstream security policy.
- Record
CVE-2026-19582- Updated
- 2026-11-02
EUVDEUVD-2026-63197 No score
Red Hat Product Security has come to the conclusion that this CVE is false due to upstream security policy.
- Record
EUVD-2026-63197- Updated
- 2026-11-02
NVD No score
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is false due to upstream security policy.
- Record
CVE-2026-19582- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-19582
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write.
- Record
DEBIAN-CVE-2026-19582- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19582
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write.
- Record
UBUNTU-CVE-2026-19582- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-97446 No score
CVE-2026-19582 affecting package binutils 2.41-13
In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write.
- Record
AZL-97446- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12315-1 No score
binutils-2.47-2.1 on GA media
These are all security issues fixed in the binutils-2.47-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12315-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsAzure Linux:3 |
through 2.41-13 | None known |
binutilsDebian:12 |
All versions, plus listed versions 2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1 Show 45 moreShow less2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1 |
None known |
binutilsDebian:13 |
All versions, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 43 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47.50.20260813-12.47.50.20260813-22.47.50.20260813-32.47.50.20260901-1 |
None known |
binutilsDebian:14 |
All versions, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 43 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47.50.20260813-12.47.50.20260813-22.47.50.20260813-32.47.50.20260901-1 |
None known |
binutilsopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.47-2.1 | 2.47-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19582 has been rejected by its source and should not be treated as a live vulnerability, published August 20, 2026.
References
Left out here: 72 versions. The JSON record has them.