Skip to content
Fencer Vulns
high 7.8

CVE-2026-18220 json

Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing

published 2026-07-29 3 mo ago modified 2026-07-30 3 mo ago also EUVD-2026-50279

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation type number space is non-contiguous (basic types 0-6, extended types at 0x10000+), but the default case in the switch statement allows arbitrary index values to reach the array access.

A specially crafted ELF/DLX object file can trigger this out-of-bounds write when processed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The vulnerability has been demonstrated to achieve arbitrary code execution via a File Stream Oriented Programming (FSOP) attack against glibc FILE structures (stderr), redirecting control flow to system().

Attack scenarios include CI/CD pipelines performing automated binary analysis, developer workstations running objdump/readelf on untrusted binaries, automated security scanning or malware analysis tools invoking binutils, and package build systems processing third-party code.

Note: This vulnerability is only exploitable when binutils is built with the DLX backend enabled (typically via --enable-targets=all).

Patch / fix

  • binutils openSUSE Tumbleweed 2.47-1.1

opensuse advisories openSUSE-SU-2026:11932-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18220 updated cvss 7.8

binutils: binutils: Out-of-bounds write in BFD DLX ELF backend relocation processing

  • Red Hat Enterprise Linux 6 binutils 2.41-63.el10 Red Hat Enterprise Linux 7 binutils, gdb-gdbserver, gdb 16.3-3.el10, binutils 2.41-63.el10 Red Hat Enterprise Linux 8 gdb, binutils, gdb-headless, gdb-gdbserver, gdb 16.3-3.el10, mingw32-binutils, +12 more Red Hat Enterprise Linux 9 gdb, binutils, gdb-minimal, gdb-headless, binutils-gold, gdb-gdbserver, +14 more Red Hat Enterprise Linux 10 gdb 16.3-3.el10, mingw32-binutils, mingw64-binutils, binutils 2.41-63.el10, mingw-binutils 2.44-1.el10, gcc-toolset-15-binutils 2.44-8.el10, +1 more Red Hat Hardened Images binutils 2.41-63.el10
    +2 more products
    Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.