This security advisory from Red Hat addresses multiple vulnerabilities in the binutils packages included in Red Hat Hardened Images. The affected packages are binutils, binutils-devel, binutils-gold, and binutils-gprofng version 2.46.1-1.hum1 for aarch64 and x86_64 architectures. The vulnerabilities include CVE-2025-11082, CVE-2025-11083, CVE-2026-3441, CVE-2026-3442, CVE-2026-4647, CVE-2026-6845, and CVE-2026-6846. These correspond to several CWEs such as CWE-209 (Information Exposure), CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read), CWE-476 (NULL Pointer Dereference), and CWE-122 (Heap-based Buffer Overflow). Red Hat has provided updated RPM packages to fix these vulnerabilities. The advisory does not include a CVSS score but classifies the severity as high.

The vulnerabilities affect the binutils packages used in Red Hat Hardened Images on aarch64 and x86_64 platforms. They represent risks including information exposure and memory corruption issues such as out-of-bounds reads and writes and null pointer dereferences. These could potentially lead to denial of service or other impacts depending on exploitation. No known exploits in the wild have been reported at the time of this advisory.

A patch is available for the affected binutils packages (version 2.46.1-1.hum1) and should be applied promptly. The update is provided by Red Hat and can be obtained via the Red Hat Hardened Images update channels. Users should follow Red Hat's official guidance for applying these updates. No additional mitigation steps are specified by the vendor advisory.