{"id":"CVE-2026-4647","aliases":["AZL-80877","AZL-80895","AZL-80904","BELL-CVE-2026-4647","CLSA-2026-1775726631","CLSA-2026-1777949670","DEBIAN-CVE-2026-4647","EUVD-2026-14435","GHSA-v858-p3pc-hqjh","RHSA-2026:33527","RHSA-2026:39022","UBUNTU-CVE-2026-4647","openSUSE-SU-2026:11932-1"],"status":"published","title":"Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00175,"percentile":0.06981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-03-23T13:37:44Z","modified":"2026-11-06T10:05:05Z","fixes":[{"ecosystem":"Azure Linux:3","package":"binutils","fixed_in":["2.41-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"crash","fixed_in":["9.0.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gdb","fixed_in":["13.2-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binutils","fixed_in":["2.47-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"crash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2-7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els6"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els6"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"binutils-gold","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els6"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cross-binutils-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els6"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cross-binutils-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els6"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cross-binutils-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-63.el9.tuxcare.els6"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-37.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-37.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"binutils-gold","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-37.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cross-binutils-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-37.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cross-binutils-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-37.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cross-binutils-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.2-37.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40-2","2.40.50.20230111-1","2.40.50.20230215-1","2.40.50.20230501-1","2.40.50.20230510-1","2.40.50.20230602-1","2.40.50.20230611-1","2.40.50.20230611-2","2.40.50.20230622-1","2.40.50.20230625-1","2.40.50.20230630-1","2.40.90.20230705-1","2.40.90.20230714-1","2.40.90.20230714-2","2.40.90.20230720-1","2.40.90.20230729-1","2.40.90.20230729-2","2.41-1","2.41-2","2.41-3","2.41-4","2.41-5","2.41-6","2.41-7","2.41.50.20230731-1","2.41.50.20230803-1","2.41.50.20230905-1","2.41.50.20231010-1","2.41.50.20231101-1","2.41.50.20231125-1","2.41.50.20231202-1","2.41.50.20231206-1","2.41.50.20231214-1","2.41.50.20231227-1","2.41.90.20240115-1","2.41.90.20240122-1","2.42-1","2.42-2","2.42-2+hurd.1","2.42-3","2.42-4","2.42.50.20240614-1","2.42.50.20240618-1","2.42.50.20240625-1","2.42.50.20240710-1","2.42.90.20240720-1","2.42.90.20240720-2","2.43-1","2.43-2","2.43.1-1","2.43.1-2","2.43.1-3","2.43.1-4","2.43.1-5","2.43.50.20240817-1","2.43.50.20240909-1","2.43.50.20241004-1","2.43.50.20241112-1","2.43.50.20241126-1","2.43.50.20241126-2","2.43.50.20241126-3","2.43.50.20241204-1","2.43.50.20241204-2","2.43.50.20241210-1","2.43.50.20241215-1","2.43.50.20241221-1","2.43.50.20241230-1","2.43.50.20250108-1","2.43.90.20250122-1","2.43.90.20250122-2","2.43.90.20250127-1","2.43.90.20250202-1","2.44-1","2.44-2","2.44-3","2.44.50.20250201-1","2.44.50.20250207-1","2.44.50.20250218-1","2.44.50.20250218-2","2.44.50.20250309-1","2.44.50.20250405-1","2.44.50.20250502-1","2.44.50.20250520-1","2.44.50.20250528-1","2.44.50.20250707-1","2.44.90.20250719-1","2.45-1","2.45-2","2.45-3","2.45-4","2.45-5","2.45-6","2.45-7","2.45-8","2.45.50.20250813-1","2.45.50.20250903-1","2.45.50.20251005-1","2.45.50.20251023-1","2.45.50.20251023-2","2.45.50.20251122-1","2.45.50.20251125-1","2.45.50.20251201-1","2.45.50.20251209-1","2.45.50.20260116-1","2.45.50.20260119-1","2.45.90.20260125-1","2.45.90.20260201-1","2.46-1","2.46-2","2.46-3","2.46.50.20260216-1","2.46.50.20260509-1","2.46.50.20260519-1","2.46.50.20260608-1","2.46.50.20260617-1","2.46.90.20260712-1","2.47-1","2.47-2","2.47-3","2.47-4","2.47-5","2.47-6","2.47.50.20260813-1","2.47.50.20260813-2","2.47.50.20260813-3","2.47.50.20260901-1","2.47.50.20261004-1","2.47.50.20261020-1","2.47.50.20261021-1"]},{"source":"osv","ecosystem":"Debian:13","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.44-3","2.44.50.20250201-1","2.44.50.20250207-1","2.44.50.20250218-1","2.44.50.20250218-2","2.44.50.20250309-1","2.44.50.20250405-1","2.44.50.20250502-1","2.44.50.20250520-1","2.44.50.20250528-1","2.44.50.20250707-1","2.44.90.20250719-1","2.45-1","2.45-2","2.45-3","2.45-4","2.45-5","2.45-6","2.45-7","2.45-8","2.45.50.20250813-1","2.45.50.20250903-1","2.45.50.20251005-1","2.45.50.20251023-1","2.45.50.20251023-2","2.45.50.20251122-1","2.45.50.20251125-1","2.45.50.20251201-1","2.45.50.20251209-1","2.45.50.20260116-1","2.45.50.20260119-1","2.45.90.20260125-1","2.45.90.20260201-1","2.46-1","2.46-2","2.46-3","2.46.50.20260216-1","2.46.50.20260509-1","2.46.50.20260519-1","2.46.50.20260608-1","2.46.50.20260617-1","2.46.90.20260712-1","2.47-1","2.47-2","2.47-3","2.47-4","2.47-5","2.47-6","2.47.50.20260813-1","2.47.50.20260813-2","2.47.50.20260813-3","2.47.50.20260901-1","2.47.50.20261004-1","2.47.50.20261020-1","2.47.50.20261021-1"]},{"source":"osv","ecosystem":"Debian:14","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1"}]}],"versions":["2.44-3","2.44.50.20250201-1","2.44.50.20250207-1","2.44.50.20250218-1","2.44.50.20250218-2","2.44.50.20250309-1","2.44.50.20250405-1","2.44.50.20250502-1","2.44.50.20250520-1","2.44.50.20250528-1","2.44.50.20250707-1","2.44.90.20250719-1","2.45-1","2.45-2","2.45-3","2.45-4","2.45-5","2.45-6","2.45-7","2.45-8","2.45.50.20250813-1","2.45.50.20250903-1","2.45.50.20251005-1","2.45.50.20251023-1","2.45.50.20251023-2","2.45.50.20251122-1","2.45.50.20251125-1","2.45.50.20251201-1","2.45.50.20251209-1","2.45.50.20260116-1","2.45.50.20260119-1","2.45.90.20260125-1","2.45.90.20260201-1","2.46-1","2.46-2","2.46-3","2.46.50.20260216-1","2.46.50.20260509-1","2.46.50.20260519-1","2.46.50.20260608-1","2.46.50.20260617-1","2.46.90.20260712-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.45.1-5.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.45.1-5.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils-gold","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.45.1-5.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils-gprofng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.45.1-5.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46.1-1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46.1-1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils-gold","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46.1-1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"binutils-gprofng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46.1-1.hum1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.52.20130913-0ubuntu1","2.23.90.20131017-1ubuntu1","2.23.90.20131116-1ubuntu1","2.23.91.20131123-1ubuntu1","2.24-1ubuntu1","2.24-1ubuntu2","2.24-2ubuntu1","2.24-2ubuntu2","2.24-2ubuntu3","2.24-4ubuntu1","2.24-5ubuntu1","2.24-5ubuntu2","2.24-5ubuntu3","2.24-5ubuntu3.1","2.24-5ubuntu13","2.24-5ubuntu14","2.24-5ubuntu14.1","2.24-5ubuntu14.2","2.24-5ubuntu14.2+esm1","2.24-5ubuntu14.2+esm2","2.24-5ubuntu14.2+esm3","2.24-5ubuntu14.2+esm5","2.24-5ubuntu14.2+esm6","2.24-5ubuntu14.2+esm7","2.24-5ubuntu14.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.1-6ubuntu1","2.25.51.20151022-0ubuntu2","2.25.51.20151022-0ubuntu3","2.25.51.20151027-0ubuntu1","2.25.51.20151028-0ubuntu1","2.25.51.20151106-0ubuntu1","2.25.51.20151113-1ubuntu1","2.25.51.20151113-2ubuntu1","2.25.90.20151125-1ubuntu1","2.25.90.20151125-2ubuntu1","2.25.90.20151211-0ubuntu1","2.25.90.20151211-0ubuntu2","2.25.90.20160101-1ubuntu1","2.25.90.20160101-1ubuntu2","2.26-2ubuntu1","2.26-3ubuntu1","2.26-4ubuntu1","2.26-5ubuntu1","2.26-6ubuntu1","2.26-7ubuntu2","2.26-8ubuntu1","2.26-8ubuntu2","2.26-8ubuntu2.1","2.26.1-1ubuntu1~16.04","2.26.1-1ubuntu1~16.04.1","2.26.1-1ubuntu1~16.04.3","2.26.1-1ubuntu1~16.04.4","2.26.1-1ubuntu1~16.04.5","2.26.1-1ubuntu1~16.04.6","2.26.1-1ubuntu1~16.04.7","2.26.1-1ubuntu1~16.04.8","2.26.1-1ubuntu1~16.04.8+esm1","2.26.1-1ubuntu1~16.04.8+esm3","2.26.1-1ubuntu1~16.04.8+esm4","2.26.1-1ubuntu1~16.04.8+esm5","2.26.1-1ubuntu1~16.04.8+esm6","2.26.1-1ubuntu1~16.04.8+esm7","2.26.1-1ubuntu1~16.04.8+esm9","2.26.1-1ubuntu1~16.04.8+esm11","2.26.1-1ubuntu1~16.04.8+esm12","2.26.1-1ubuntu1~16.04.8+esm13","2.26.1-1ubuntu1~16.04.8+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.29.1-4ubuntu1","2.29.1-6ubuntu1","2.29.1-7ubuntu1","2.29.1-8ubuntu1","2.29.1-10ubuntu1","2.29.1-12ubuntu1","2.30-4ubuntu1","2.30-5ubuntu1","2.30-7ubuntu1","2.30-8ubuntu1","2.30-9ubuntu1","2.30-10ubuntu1","2.30-11ubuntu1","2.30-14ubuntu2","2.30-15ubuntu1","2.30-20ubuntu2~18.04","2.30-21ubuntu1~18.04","2.30-21ubuntu1~18.04.1","2.30-21ubuntu1~18.04.2","2.30-21ubuntu1~18.04.3","2.30-21ubuntu1~18.04.4","2.30-21ubuntu1~18.04.5","2.30-21ubuntu1~18.04.7","2.30-21ubuntu1~18.04.8","2.30-21ubuntu1~18.04.9","2.30-21ubuntu1~18.04.9+esm1","2.30-21ubuntu1~18.04.9+esm3","2.30-21ubuntu1~18.04.9+esm4","2.30-21ubuntu1~18.04.9+esm5","2.30-21ubuntu1~18.04.9+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.33-2ubuntu1","2.33.1-1ubuntu1","2.33.1-5ubuntu1","2.33.1-6ubuntu1","2.33.1-6ubuntu3","2.33.90.20200122-1ubuntu2","2.34-1ubuntu1","2.34-3ubuntu1","2.34-4ubuntu1","2.34-5ubuntu1","2.34-6ubuntu1","2.34-6ubuntu1.1","2.34-6ubuntu1.3","2.34-6ubuntu1.4","2.34-6ubuntu1.5","2.34-6ubuntu1.6","2.34-6ubuntu1.7","2.34-6ubuntu1.8","2.34-6ubuntu1.9","2.34-6ubuntu1.10","2.34-6ubuntu1.11","2.34-6ubuntu1.11+esm1","2.34-6ubuntu1.11+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.37-7ubuntu1","2.37-9ubuntu1","2.37-10ubuntu1","2.37.50.20220106-2ubuntu1","2.37.90.20220126-0ubuntu1","2.37.90.20220130-0ubuntu2","2.38-1ubuntu1","2.38-2ubuntu1","2.38-3ubuntu1","2.38-4ubuntu2","2.38-4ubuntu2.1","2.38-4ubuntu2.2","2.38-4ubuntu2.3","2.38-4ubuntu2.4","2.38-4ubuntu2.5","2.38-4ubuntu2.6","2.38-4ubuntu2.7","2.38-4ubuntu2.8","2.38-4ubuntu2.10","2.38-4ubuntu2.11","2.38-4ubuntu2.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-5ubuntu1","2.41-6ubuntu1","2.41.50.20231206-1ubuntu1","2.41.50.20231214-1ubuntu1","2.41.50.20231227-1ubuntu1","2.41.90.20240122-1ubuntu1","2.42-2ubuntu1","2.42-3ubuntu1","2.42-4ubuntu1","2.42-4ubuntu2","2.42-4ubuntu2.3","2.42-4ubuntu2.4","2.42-4ubuntu2.5","2.42-4ubuntu2.6","2.42-4ubuntu2.7","2.42-4ubuntu2.8","2.42-4ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.44-3ubuntu1","2.44.50.20250602-0ubuntu1","2.44.50.20250604-0ubuntu2","2.44.50.20250616-0ubuntu1","2.44.50.20250707-1ubuntu1","2.45-1ubuntu1","2.45-3ubuntu3","2.45-6ubuntu1","2.45-7ubuntu1","2.45-7ubuntu1.1","2.45-7ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46-3ubuntu2","2.46.50.20260608-1ubuntu1","2.47-2ubuntu1","2.47-6ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.45-7ubuntu1","2.45-7ubuntu2","2.45-8ubuntu1","2.45.50.20251125-1ubuntu1","2.45.50.20251201-1ubuntu1","2.45.50.20251209-1ubuntu1","2.45.50.20260119-1ubuntu1","2.46-1ubuntu1","2.46-2ubuntu1","2.46-3ubuntu1","2.46-3ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"binutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1.1"}]}],"bundled":16}],"products":[{"vendor":"gnu","product":"binutils"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:33527","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39022","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4647","tags":["vdb-entry","x_refsource_REDHAT","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450302","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=33919","tags":["Broken Link","report","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4647","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v858-p3pc-hqjh"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-4647","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775726631.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777949670.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4647.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3441","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3442","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6846","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33527.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443826","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3441","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443828","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3442","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4647","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6846","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11082","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11083","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6845","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39022.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2399943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11082","tags":["advisory"]},{"url":"https://sourceware.org/bugzilla/attachment.cgi?id=16358","tags":["article"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=33464","tags":["article"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2","tags":["article"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8","tags":["article"]},{"url":"https://vuldb.com/?ctiid.326123","tags":["article"]},{"url":"https://vuldb.com/?id.326123","tags":["article"]},{"url":"https://vuldb.com/?submit.661276","tags":["article"]},{"url":"https://www.gnu.org/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2399948","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11083","tags":["advisory"]},{"url":"https://sourceware.org/bugzilla/attachment.cgi?id=16353","tags":["article"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=33457","tags":["article"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=33457#c1","tags":["article"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490","tags":["article"]},{"url":"https://vuldb.com/?ctiid.326124","tags":["article"]},{"url":"https://vuldb.com/?id.326124","tags":["article"]},{"url":"https://vuldb.com/?submit.661277","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6845","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-4647","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6846","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-4647","title":"Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T13:37:44.413Z","modified":"2026-11-05T21:10:34.024Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-14435","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T13:37:44Z","modified":"2026-11-05T21:10:34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T22:02:09.198589Z"}],"ghsa":[{"id":"GHSA-v858-p3pc-hqjh","title":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary...","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T15:30:44Z","modified":"2026-07-14T00:31:00Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:26.474991Z"}],"nvd":[{"id":"CVE-2026-4647","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T14:16:36.753Z","modified":"2026-11-05T22:18:44.9Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T23:57:16.793383Z"}],"osv":[{"id":"BELL-CVE-2026-4647","title":"CVE-2026-4647 does not affect BellSoft software","status":"withdrawn","published":"2026-03-24T06:08:52.890402Z","modified":"2026-04-03T07:15:17.921947Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"CVE-2026-4647","title":"Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T13:37:44.413Z","modified":"2026-11-07T02:30:30.874724826Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T03:08:06.142401Z"},{"id":"DEBIAN-CVE-2026-4647","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T14:16:36.753Z","modified":"2026-11-06T10:05:05.186787182Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"RHSA-2026:33527","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-01T10:19:40Z","modified":"2026-10-06T10:31:23.199867757Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:39022","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-14T10:09:23Z","modified":"2026-10-15T10:18:32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-4647","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T14:16:00Z","modified":"2026-10-17T12:58:24.154220358Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:30.797112Z"},{"id":"AZL-80877","title":"CVE-2026-4647 affecting package binutils for versions less than 2.41-11","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T14:16:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-80895","title":"CVE-2026-4647 affecting package crash for versions less than 9.0.0-2","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T14:16:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-80904","title":"CVE-2026-4647 affecting package gdb for versions less than 13.2-7","description":"A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.","status":"published","published":"2026-03-23T14:16:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1775726631","title":"binutils: Fix of 9 CVEs","description":"- CVE-2023-1972: fix heap buffer overflow in _bfd_elf_slurp_version_tables\n- CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry\n- CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols\n- CVE-2025-11839: fix abort in tg_tag_type with fuzzed input\n- CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing\n- CVE-2025-3198: fix memory leak in objdump display_info\n- CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF\n- CVE-2025-69652: fix abort in readelf from malformed DWARF debug info\n- CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing","status":"published","published":"2026-04-24T09:04:21Z","modified":"2026-06-01T00:32:46.809443471Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777949670","title":"binutils: Fix of 8 CVEs","description":"- CVE-2025-11412: fix out-of-bounds read in bfd_elf_gc_record_vtentry\n- CVE-2025-11413: fix out-of-bounds read in elf_link_add_object_symbols\n- CVE-2025-11839: fix abort in tg_tag_type with fuzzed input\n- CVE-2025-11840: fix SEGV from NULL howto name in coff reloc processing\n- CVE-2025-3198: fix memory leak in objdump display_info\n- CVE-2026-4647: fix out-of-bounds read in XCOFF relocation processing\n- CVE-2025-69645: fix abort in byte_get_little_endian from malformed DWARF\n- CVE-2025-69652: fix abort in readelf from malformed DWARF debug info","status":"published","published":"2026-05-05T02:54:34Z","modified":"2026-10-21T10:45:54.816006313Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"openSUSE-SU-2026:11932-1","title":"binutils-2.47-1.1 on GA media","description":"These are all security issues fixed in the binutils-2.47-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-01T11:15:05.44014221Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}