Bug 2450302 (CVE-2026-4647)

Summary: CVE-2026-4647 binutils: Out-of-Bounds Read in XCOFF Relocation Processing in GNU Binutils BFD Library
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bavowem414, crizzo, jmitchel, kshier, pbohmill, teagle
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2450314, 2450315, 2450316, 2450320, 2450321, 2450317, 2450318, 2450319    
Bug Blocks:    

Description OSIDB Bzimport 2026-03-23 12:56:52 UTC 
An out-of-bounds read vulnerability in the BFD library of GNU Binutils affects the functions xcoff_ppc_relocate_section() and xcoff64_ppc_relocate_section() in coff-rs6000.c and coff64-rs6000.c. The flaw is caused by improper validation of the relocation type field (r_type), which is read from input files and used as an array index without adequate bounds checking. This issue affects all versions of GNU Binutils prior to 2.47. When a specially crafted XCOFF object file is processed, this can lead to out-of-bounds memory access, potentially causing a crash, information disclosure, or unintended control flow behavior.
Comment 2 krisebay 2026-03-24 09:29:02 UTC 
The functions xcoff_ppc_relocate_section() and xcoff64_ppc_relocate_section() in coff-rs6000.c and coff64-rs6000.c are impacted by an out-of-bounds read vulnerability in the BFD library of GNU Binutils.  https://snowrider-2.io