Out-of-Bounds Write Vulnerability in GNU Binutils Affecting DLX Backend
CVE-2026-18220

7.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
29 July 2026

What is CVE-2026-18220?

A critical flaw has been identified in the DLX ELF backend of GNU Binutils, specifically within the dlx_rtype_to_howto() function. The vulnerability arises from insufficient bounds checking on relocatable type values controlled by attackers, leading to possible out-of-bounds write access. This can happen when processing specially crafted ELF/DLX object files through BFD tools like objdump and readelf. By exploiting this flaw, attackers could trigger arbitrary code execution via File Stream Oriented Programming (FSOP) attacks, potentially targeting control flows and redirecting execution to malicious commands. Instances such as CI/CD pipelines, developer workstations, and automated security tools using these binutils are particularly at risk, especially when built with the DLX backend.

References

https://access.redhat.com/security/cve/CVE-2026-18220
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2507670
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.