An out-of-bounds write vulnerability exists in the dlx_rtype_to_howto() function of the BFD library's DLX ELF backend in GNU binutils. The function fails to properly validate attacker-controlled relocation type values before indexing into the dlx_elf_howto_table[] array. The DLX relocation type space is non-contiguous, but the default case in the switch statement allows arbitrary indices, leading to out-of-bounds writes. A specially crafted ELF/DLX object file can exploit this flaw when processed by any BFD-consuming tool, potentially enabling arbitrary code execution through a File Stream Oriented Programming attack targeting glibc FILE structures. This vulnerability is exploitable only if binutils is compiled with the DLX backend enabled (commonly via --enable-targets=all). Attack vectors include developer workstations, CI/CD pipelines, automated security scanning, and package build systems handling untrusted binaries.

Successful exploitation can lead to arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability affects multiple binutils tools that process ELF/DLX files, potentially compromising systems that analyze or build untrusted binaries. However, exploitation requires the DLX backend to be enabled in binutils, which is not typical in all builds. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18220 for current remediation guidance. Until a patch is available, avoid processing untrusted ELF/DLX binaries with binutils tools built with the DLX backend enabled. Consider rebuilding binutils without the DLX backend if it is not required in your environment.