CVE-2026-4647
Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
6.1
Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
CVE-2026-4647- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-14435
6.1
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
EUVD-2026-14435- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-v858-p3pc-hqjh
6.1
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary...
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
GHSA-v858-p3pc-hqjh- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
6.1
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
CVE-2026-4647- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVBELL-CVE-2026-4647
6.1
CVE-2026-4647 does not affect BellSoft software
- Record
BELL-CVE-2026-4647- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSV
6.1
Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
CVE-2026-4647- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-07
Show 10 moreShow less
OSVDEBIAN-CVE-2026-4647
6.1
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
DEBIAN-CVE-2026-4647- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
OSVRHSA-2026:33527
7.8
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:33527- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:39022
7.8
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:39022- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-4647
6.1
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
UBUNTU-CVE-2026-4647- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVAZL-80877 No score
CVE-2026-4647 affecting package binutils for versions less than 2.41-11
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
AZL-80877- Updated
- 2026-11-05
OSVAZL-80895 No score
CVE-2026-4647 affecting package crash for versions less than 9.0.0-2
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
AZL-80895- Updated
- 2026-11-05
OSVAZL-80904 No score
CVE-2026-4647 affecting package gdb for versions less than 13.2-7
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Record
AZL-80904- Updated
- 2026-11-05
OSVCLSA-2026-1775726631 No score
binutils: Fix of 9 CVEs
- CVE-2023-1972: fix heap buffer overflow in _bfd_elf_slurp_version_tables
- CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry
- CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols
- CVE-2025-11839: fix abort in tg_tag_type with fuzzed input
- CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing
- CVE-2025-3198: fix memory leak in objdump display_info
- CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF
- CVE-2025-69652: fix abort in readelf from malformed DWARF debug info
- CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing
- Record
CLSA-2026-1775726631- Updated
- 2026-11-02
OSVCLSA-2026-1777949670 No score
binutils: Fix of 8 CVEs
- CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry
- CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols
- CVE-2025-11839: fix abort in tg_tag_type with fuzzed input
- CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing
- CVE-2025-3198: fix memory leak in objdump display_info
- CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing
- CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF
- CVE-2025-69652: fix abort in readelf from malformed DWARF debug info
- Record
CLSA-2026-1777949670- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11932-1 No score
binutils-2.47-1.1 on GA media
These are all security issues fixed in the binutils-2.47-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11932-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsAzure Linux:3 |
before 2.41-11 | 2.41-11 |
crashAzure Linux:3 |
before 9.0.0-2 | 9.0.0-2 |
gdbAzure Linux:3 |
before 13.2-7 | 13.2-7 |
binutilsTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
binutils-develTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
binutils-goldTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
cross-binutils-aarch64TuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
cross-binutils-ppc64leTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
cross-binutils-s390xTuxCare:AlmaLinux:9.6 From an advisory covering 9 CVEs |
before 2.35.2-63.el9.tuxcare.els6 | 2.35.2-63.el9.tuxcare.els6 |
binutilsTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
binutils-develTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
binutils-goldTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
cross-binutils-aarch64TuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
cross-binutils-ppc64leTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
cross-binutils-s390xTuxCare:AlmaLinux:9.2 From an advisory covering 8 CVEs |
before 2.35.2-37.el9.tuxcare.els6 | 2.35.2-37.el9.tuxcare.els6 |
binutilsDebian:12 |
All versions, plus listed versions 2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1 Show 45 moreShow less2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1 |
None known |
binutilsDebian:13 |
All versions, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 45 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-12.47-12.47-22.47-32.47-42.47-52.47-62.47.50.20260813-12.47.50.20260813-2 |
None known |
binutilsDebian:14 |
before 2.47-1, plus listed versions 2.44-32.44.50.20250201-12.44.50.20250207-12.44.50.20250218-12.44.50.20250218-2 Show 37 moreShow less2.44.50.20250309-12.44.50.20250405-12.44.50.20250502-12.44.50.20250520-12.44.50.20250528-12.44.50.20250707-12.44.90.20250719-12.45-12.45-22.45-32.45-42.45-52.45-62.45-72.45-82.45.50.20250813-12.45.50.20250903-12.45.50.20251005-12.45.50.20251023-12.45.50.20251023-22.45.50.20251122-12.45.50.20251125-12.45.50.20251201-12.45.50.20251209-12.45.50.20260116-12.45.50.20260119-12.45.90.20260125-12.45.90.20260201-12.46-12.46-22.46-32.46.50.20260216-12.46.50.20260509-12.46.50.20260519-12.46.50.20260608-12.46.50.20260617-12.46.90.20260712-1 |
2.47-1 |
binutilsRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:2.45.1-5.1.hum1 | 0:2.45.1-5.1.hum1 |
binutils-develRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:2.45.1-5.1.hum1 | 0:2.45.1-5.1.hum1 |
binutils-goldRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:2.45.1-5.1.hum1 | 0:2.45.1-5.1.hum1 |
binutils-gprofngRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:2.45.1-5.1.hum1 | 0:2.45.1-5.1.hum1 |
binutilsRed Hat:hummingbird:1 From an advisory covering 7 CVEs |
before 0:2.46.1-1.hum1 | 0:2.46.1-1.hum1 |
binutils-develRed Hat:hummingbird:1 From an advisory covering 7 CVEs |
before 0:2.46.1-1.hum1 | 0:2.46.1-1.hum1 |
binutils-goldRed Hat:hummingbird:1 From an advisory covering 7 CVEs |
before 0:2.46.1-1.hum1 | 0:2.46.1-1.hum1 |
binutils-gprofngRed Hat:hummingbird:1 From an advisory covering 7 CVEs |
before 0:2.46.1-1.hum1 | 0:2.46.1-1.hum1 |
binutilsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.23.52.20130913-0ubuntu12.23.90.20131017-1ubuntu12.23.90.20131116-1ubuntu12.23.91.20131123-1ubuntu12.24-1ubuntu1 Show 20 moreShow less2.24-1ubuntu22.24-2ubuntu12.24-2ubuntu22.24-2ubuntu32.24-4ubuntu12.24-5ubuntu12.24-5ubuntu22.24-5ubuntu32.24-5ubuntu3.12.24-5ubuntu132.24-5ubuntu142.24-5ubuntu14.12.24-5ubuntu14.22.24-5ubuntu14.2+esm12.24-5ubuntu14.2+esm22.24-5ubuntu14.2+esm32.24-5ubuntu14.2+esm52.24-5ubuntu14.2+esm62.24-5ubuntu14.2+esm72.24-5ubuntu14.2+esm8 |
None known |
binutilsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.25.1-6ubuntu12.25.51.20151022-0ubuntu22.25.51.20151022-0ubuntu32.25.51.20151027-0ubuntu12.25.51.20151028-0ubuntu1 Show 37 moreShow less2.25.51.20151106-0ubuntu12.25.51.20151113-1ubuntu12.25.51.20151113-2ubuntu12.25.90.20151125-1ubuntu12.25.90.20151125-2ubuntu12.25.90.20151211-0ubuntu12.25.90.20151211-0ubuntu22.25.90.20160101-1ubuntu12.25.90.20160101-1ubuntu22.26-2ubuntu12.26-3ubuntu12.26-4ubuntu12.26-5ubuntu12.26-6ubuntu12.26-7ubuntu22.26-8ubuntu12.26-8ubuntu22.26-8ubuntu2.12.26.1-1ubuntu1~16.042.26.1-1ubuntu1~16.04.12.26.1-1ubuntu1~16.04.32.26.1-1ubuntu1~16.04.42.26.1-1ubuntu1~16.04.52.26.1-1ubuntu1~16.04.62.26.1-1ubuntu1~16.04.72.26.1-1ubuntu1~16.04.82.26.1-1ubuntu1~16.04.8+esm12.26.1-1ubuntu1~16.04.8+esm32.26.1-1ubuntu1~16.04.8+esm42.26.1-1ubuntu1~16.04.8+esm52.26.1-1ubuntu1~16.04.8+esm62.26.1-1ubuntu1~16.04.8+esm72.26.1-1ubuntu1~16.04.8+esm92.26.1-1ubuntu1~16.04.8+esm112.26.1-1ubuntu1~16.04.8+esm122.26.1-1ubuntu1~16.04.8+esm132.26.1-1ubuntu1~16.04.8+esm14 |
None known |
binutilsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.29.1-4ubuntu12.29.1-6ubuntu12.29.1-7ubuntu12.29.1-8ubuntu12.29.1-10ubuntu1 Show 25 moreShow less2.29.1-12ubuntu12.30-4ubuntu12.30-5ubuntu12.30-7ubuntu12.30-8ubuntu12.30-9ubuntu12.30-10ubuntu12.30-11ubuntu12.30-14ubuntu22.30-15ubuntu12.30-20ubuntu2~18.042.30-21ubuntu1~18.042.30-21ubuntu1~18.04.12.30-21ubuntu1~18.04.22.30-21ubuntu1~18.04.32.30-21ubuntu1~18.04.42.30-21ubuntu1~18.04.52.30-21ubuntu1~18.04.72.30-21ubuntu1~18.04.82.30-21ubuntu1~18.04.92.30-21ubuntu1~18.04.9+esm12.30-21ubuntu1~18.04.9+esm32.30-21ubuntu1~18.04.9+esm42.30-21ubuntu1~18.04.9+esm52.30-21ubuntu1~18.04.9+esm13 |
None known |
binutilsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.33-2ubuntu12.33.1-1ubuntu12.33.1-5ubuntu12.33.1-6ubuntu12.33.1-6ubuntu3 Show 18 moreShow less2.33.90.20200122-1ubuntu22.34-1ubuntu12.34-3ubuntu12.34-4ubuntu12.34-5ubuntu12.34-6ubuntu12.34-6ubuntu1.12.34-6ubuntu1.32.34-6ubuntu1.42.34-6ubuntu1.52.34-6ubuntu1.62.34-6ubuntu1.72.34-6ubuntu1.82.34-6ubuntu1.92.34-6ubuntu1.102.34-6ubuntu1.112.34-6ubuntu1.11+esm12.34-6ubuntu1.11+esm2 |
None known |
binutilsUbuntu:22.04:LTS |
All versions, plus listed versions 2.37-7ubuntu12.37-9ubuntu12.37-10ubuntu12.37.50.20220106-2ubuntu12.37.90.20220126-0ubuntu1 Show 16 moreShow less2.37.90.20220130-0ubuntu22.38-1ubuntu12.38-2ubuntu12.38-3ubuntu12.38-4ubuntu22.38-4ubuntu2.12.38-4ubuntu2.22.38-4ubuntu2.32.38-4ubuntu2.42.38-4ubuntu2.52.38-4ubuntu2.62.38-4ubuntu2.72.38-4ubuntu2.82.38-4ubuntu2.102.38-4ubuntu2.112.38-4ubuntu2.12 |
None known |
binutilsUbuntu:24.04:LTS |
All versions, plus listed versions 2.41-5ubuntu12.41-6ubuntu12.41.50.20231206-1ubuntu12.41.50.20231214-1ubuntu12.41.50.20231227-1ubuntu1 Show 12 moreShow less2.41.90.20240122-1ubuntu12.42-2ubuntu12.42-3ubuntu12.42-4ubuntu12.42-4ubuntu22.42-4ubuntu2.32.42-4ubuntu2.42.42-4ubuntu2.52.42-4ubuntu2.62.42-4ubuntu2.72.42-4ubuntu2.82.42-4ubuntu2.10 |
None known |
binutilsUbuntu:25.10 |
All versions, plus listed versions 2.44-3ubuntu12.44.50.20250602-0ubuntu12.44.50.20250604-0ubuntu22.44.50.20250616-0ubuntu12.44.50.20250707-1ubuntu1 Show 6 moreShow less2.45-1ubuntu12.45-3ubuntu32.45-6ubuntu12.45-7ubuntu12.45-7ubuntu1.12.45-7ubuntu1.2 |
None known |
binutilsUbuntu:26.10 |
All versions, plus listed versions 2.46-3ubuntu22.46.50.20260608-1ubuntu12.47-2ubuntu12.47-6ubuntu1 |
None known |
binutilsUbuntu:26.04:LTS |
All versions, plus listed versions 2.45-7ubuntu12.45-7ubuntu22.45-8ubuntu12.45.50.20251125-1ubuntu12.45.50.20251201-1ubuntu1 Show 6 moreShow less2.45.50.20251209-1ubuntu12.45.50.20260119-1ubuntu12.46-1ubuntu12.46-2ubuntu12.46-3ubuntu12.46-3ubuntu2 |
None known |
binutilsopenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 2.47-1.1 | 2.47-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | CVE List, EUVD, NVD | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-4647 is a medium vulnerability (CVSS 6.1) in Gnu Binutils, published March 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in binutils 2.41-11.
References
access.redhat.com/errata/RHSA-2026:33527
access.redhat.com/errata/RHSA-2026:39022
access.redhat.com/security/cve/CVE-2026-4647
bugzilla.redhat.com/show_bug.cgi?id=2450302
sourceware.org/bugzilla/show_bug.cgi?id=33919
nvd.nist.gov/vuln/detail/CVE-2026-4647
Show 67 moreShow less
github.com/advisories/GHSA-v858-p3pc-hqjh
docs.bell-sw.com/security/cves/CVE-2026-4647
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775726631.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777949670.html
access.redhat.com/downloads/content/package-browser
catalog.redhat.com/software/containers
github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4647.json
security-tracker.debian.org/tracker/CVE-2026-4647
access.redhat.com/security/cve/CVE-2026-3441
access.redhat.com/security/cve/CVE-2026-3442
access.redhat.com/security/cve/CVE-2026-6846
access.redhat.com/security/updates/classification
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33527.json
bugzilla.redhat.com/show_bug.cgi?id=2443826
cve.org/CVERecord?id=CVE-2026-3441
nvd.nist.gov/vuln/detail/CVE-2026-3441
bugzilla.redhat.com/show_bug.cgi?id=2443828
cve.org/CVERecord?id=CVE-2026-3442
nvd.nist.gov/vuln/detail/CVE-2026-3442
cve.org/CVERecord?id=CVE-2026-4647
bugzilla.redhat.com/show_bug.cgi?id=2460006
cve.org/CVERecord?id=CVE-2026-6846
nvd.nist.gov/vuln/detail/CVE-2026-6846
access.redhat.com/security/cve/CVE-2025-11082
access.redhat.com/security/cve/CVE-2025-11083
access.redhat.com/security/cve/CVE-2026-6845
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39022.json
bugzilla.redhat.com/show_bug.cgi?id=2399943
cve.org/CVERecord?id=CVE-2025-11082
nvd.nist.gov/vuln/detail/CVE-2025-11082
sourceware.org/bugzilla/attachment.cgi?id=16358
sourceware.org/bugzilla/show_bug.cgi?id=33464
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8
vuldb.com?ctiid.326123
vuldb.com?id.326123
vuldb.com?submit.661276
gnu.org
bugzilla.redhat.com/show_bug.cgi?id=2399948
cve.org/CVERecord?id=CVE-2025-11083
nvd.nist.gov/vuln/detail/CVE-2025-11083
sourceware.org/bugzilla/attachment.cgi?id=16353
sourceware.org/bugzilla/show_bug.cgi?id=33457
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490
vuldb.com?ctiid.326124
vuldb.com?id.326124
vuldb.com?submit.661277
bugzilla.redhat.com/show_bug.cgi?id=2460012
cve.org/CVERecord?id=CVE-2026-6845
nvd.nist.gov/vuln/detail/CVE-2026-6845
ubuntu.com/security/CVE-2026-4647
suse.com/security/cve/CVE-2025-11082
suse.com/security/cve/CVE-2025-11839
suse.com/security/cve/CVE-2025-11840
suse.com/security/cve/CVE-2025-69644
suse.com/security/cve/CVE-2025-69645
suse.com/security/cve/CVE-2025-69646
suse.com/security/cve/CVE-2025-69647
suse.com/security/cve/CVE-2025-69648
suse.com/security/cve/CVE-2025-69649
suse.com/security/cve/CVE-2025-69652
suse.com/security/cve/CVE-2026-15003
suse.com/security/cve/CVE-2026-18220
suse.com/security/cve/CVE-2026-3441
suse.com/security/cve/CVE-2026-3442
suse.com/security/cve/CVE-2026-4647
suse.com/security/cve/CVE-2026-6846
Left out here: 84 versions. The JSON record has them.