CVE-2026-4647: Out-of-bounds Read in Red Hat Red Hat Hardened Images
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
AI Analysis
Technical Summary
The vulnerability CVE-2026-4647 affects the GNU Binutils BFD library, a component widely used for handling binary files such as object files and executables. The issue arises when processing specially crafted XCOFF object files where a relocation type value is not properly validated before use, leading to an out-of-bounds read. This can cause affected programs to crash or expose unintended memory contents. Red Hat Hardened Images include affected binutils packages. Red Hat has issued security advisories RHSA-2026:33527 and RHSA-2026:39022 providing updated binutils RPMs (versions 2.45.1-5.1.hum1 and 2.46.1-1.hum1) that fix this vulnerability along with others. The advisories direct users to apply these updates via https://images.redhat.com/.
Potential Impact
Successful exploitation of this vulnerability can cause denial-of-service due to application crashes or limited information disclosure through exposure of unintended memory contents. The CVSS 3.1 base score is 6.1 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.
Mitigation Recommendations
Red Hat has released official security updates for Red Hat Hardened Images that include patched versions of binutils addressing CVE-2026-4647. Users should apply the updates provided in advisories RHSA-2026:33527 and RHSA-2026:39022 by following instructions at https://images.redhat.com/. Applying these updates mitigates the vulnerability. No additional vendor-recommended mitigations or workarounds are indicated.
CVE-2026-4647: Out-of-bounds Read in Red Hat Red Hat Hardened Images
Description
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
CVSS v3.1
Score 6.1medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-4647 affects the GNU Binutils BFD library, a component widely used for handling binary files such as object files and executables. The issue arises when processing specially crafted XCOFF object files where a relocation type value is not properly validated before use, leading to an out-of-bounds read. This can cause affected programs to crash or expose unintended memory contents. Red Hat Hardened Images include affected binutils packages. Red Hat has issued security advisories RHSA-2026:33527 and RHSA-2026:39022 providing updated binutils RPMs (versions 2.45.1-5.1.hum1 and 2.46.1-1.hum1) that fix this vulnerability along with others. The advisories direct users to apply these updates via https://images.redhat.com/.
Potential Impact
Successful exploitation of this vulnerability can cause denial-of-service due to application crashes or limited information disclosure through exposure of unintended memory contents. The CVSS 3.1 base score is 6.1 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.
Mitigation Recommendations
Red Hat has released official security updates for Red Hat Hardened Images that include patched versions of binutils addressing CVE-2026-4647. Users should apply the updates provided in advisories RHSA-2026:33527 and RHSA-2026:39022 by following instructions at https://images.redhat.com/. Applying these updates mitigates the vulnerability. No additional vendor-recommended mitigations or workarounds are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-03-23T12:48:06.297Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-4647","vendor":"Red Hat"}]
Threat ID: 69c14797f4197a8e3b602ac4
Added to database: 03/23/2026, 14:00:55 UTC
Last enriched: 07/21/2026, 19:01:31 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 151
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.