This vulnerability involves a heap-buffer-overflow in binutils when handling specially crafted Extended Common Object File Format (XCOFF) files during the linking process on Red Hat Enterprise Linux 10. Exploitation requires local attacker interaction to convince a user to process a malicious file. Successful exploitation could allow arbitrary code execution or cause a denial of service. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

The impact includes potential arbitrary code execution, enabling an attacker to run unauthorized commands, and denial of service, which could make the system unavailable. The vulnerability requires local user interaction to trigger and does not require prior privileges, increasing risk if a user is tricked into processing a malicious file.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6846 for current remediation guidance. Until an official fix is available, avoid processing untrusted XCOFF object files and limit local user access to trusted files only.