CVE-2026-15003 is a heap-buffer-overflow vulnerability in the GNU Binutils linker (ld) that occurs when processing maliciously crafted 32-bit XCOFF object files. The vulnerability arises because the linker uses an unvalidated field from untrusted input as an array index, causing out-of-bounds reads of heap memory. This can lead to information disclosure of heap metadata or cause the linker to crash, resulting in denial of service. The issue affects binutils packages in Red Hat Hardened Images for aarch64 and x86_64 architectures. Red Hat has published an advisory but has not released a patch or fix for this vulnerability. Mitigation options are either unavailable or unsuitable according to Red Hat's criteria.

An attacker who can supply a specially crafted 32-bit XCOFF object file to the linker may cause it to read memory out of bounds. This can disclose sensitive heap data, potentially including cryptographic keys or other confidential information, and cause the linker to crash, resulting in denial of service. The vulnerability requires local access with low privileges and low attack complexity. There is no known active exploitation in the wild. The confidentiality impact is low, integrity impact is none, and availability impact is high.

Red Hat currently does not provide an official fix or patch for this vulnerability. Mitigation options are either not available or do not meet Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. If possible, avoid processing untrusted 32-bit XCOFF object files with the affected binutils linker until a fix is released.