CVE-2026-6846

Description

A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable.

CVSS breakdown

Affected products

• gnu / Binutils2.46
• RedHat / enterprise_linux6.0 – 6.0
• RedHat / enterprise_linux9.0 – 9.0
• RedHat / enterprise_linux10.0 – 10.0
• RedHat / enterprise_linux8.0 – 8.0
• RedHat / hardened_images
• RedHat / openshift_container_platform4.0 – 4.0

References

• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:33527
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:39022
• VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-6846
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2460006