CVE-2026-3442

CVE-2026-3442 is a reported heap-based buffer overflow in the GNU Binutils bfd linker, caused by a missing r_symndx bounds check in xcoff_link_add_symbols. Exploitation would involve processing a crafted XCOFF object file and could lead to information disclosure or an application crash/DoS. Multi...

CVE-2026-3442

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may...

Unity Linux 20.1070a Security Update: binutils (UTSA-2026-006196)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006196 advisory. A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copysection of the file binutils/objcopy.c...

Unity Linux 20.1070a Security Update: binutils (UTSA-2026-006200)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006200 advisory. A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfdelfsetgroupcontents of the file...

mingw64-binutils-2.45.1-2.1 on GA media (moderate)

mingw64-binutils-2.45.1-2.1 on GA media Announcement ID: openSUSE-SU-2026:10331-1 Rating: moderate Cross-References: CVE-2025-7545 CVE-2025-7546 CVSS scores: CVE-2025-7545 SUSE : 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVE-2025-7545 SUSE : 6.9...

mingw32-binutils-2.45.1-2.1 on GA media (moderate)

mingw32-binutils-2.45.1-2.1 on GA media Announcement ID: openSUSE-SU-2026:10330-1 Rating: moderate Cross-References: CVE-2025-7545 CVE-2025-7546 CVSS scores: CVE-2025-7545 SUSE : 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVE-2025-7545 SUSE : 6.9...

Exploit for Improper Input Validation in Gnu Binutils

CVE-...

OPENSUSE-SU-2026:10330-1 mingw32-binutils-2.45.1-2.1 on GA media

These are all security issues fixed in the mingw32-binutils-2.45.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10331-1 mingw64-binutils-2.45.1-2.1 on GA media

These are all security issues fixed in the mingw64-binutils-2.45.1-2.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the processdebug_info function in the DWARF component of the GNU Binutils development toolset allows a attacker to trigger a service failure.

The vulnerability of the processdebuginfo function in the DWARF component of the GNU Binutils development environment is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2025-69649

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into displayrelocations, resulting in a segmentation fault SIGSEGV and...

SUSE CVE-2025-69650

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dumprelocations may return early without initializing the allrelocations array. As a result, processgotsectioncontents may pass ...

SUSE CVE-2025-69652

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort SIGABRT when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in processdebuginfo, an invalid debuginfop state may propagate into DWARF attribute parsing...

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.

...

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

...

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.

...

EulerOS 2.0 SP13 : gdb (EulerOS-SA-2026-1234)

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw has been found in GNU Binutils 2.45. Impacted is the function bfdelfparseehframe of the file bfd/elf-eh-frame.c of the component Linker...

The vulnerability of the link_order_scan() function in the ld/ldelfgen.c component of the GNU Binutils development environment allows a attacker to trigger a service failure.

The vulnerability of the linkorderscan function in the ld/ldelfgen.c component of the GNU Binutils development environment is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `__sanitizer::internal_strlen` function in the `binutils/nm.c` component of the GNU Binutils development environment allows a attacker to cause a service failure.

The vulnerability of the sanitizer::internalstrlen function in the binutils/nm.c component of the GNU Binutils development environment is related to the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a servic...

The vulnerability of the tg_tag_type() function in the prdbg.c component of the GNU Binutils development environment allows a hacker to induce a service failure.

The vulnerability of the tgtagtype function in the prdbg.c component of the GNU Binutils development environment is related to an unvalidated return value. Exploiting this vulnerability could allow an attacker to cause a service failure...