Threats affecting pkg:rpm/redhat/binutils

This update includes the following RPMs: binutils: * binutils-2.45.1-5.1.hum1 (aarch64, x86_64) * binutils-devel-2.45.1-5.1.hum1 (aarch64, x86_64) * binutils-gold-2.45.1-5.1.hum1 (aarch64, x86_64) * binutils-gprofng-2.45.1-5.1.hum1 (aarch64, x86_64) * binutils-2.45.1-5.1.hum1.src (src) Security Fix(es): binutils: * CVE-2026-3441 * CVE-2026-3442 * CVE-2026-4647 * CVE-2026-6846

A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.

A heap-based overflow vulnerability (CVE-2025-11083) was discovered in the GNU Binutils linker component included in Red Hat Enterprise Linux 8.8. This vulnerability affects the binutils package, which provides various binary utilities for object code manipulation. Red Hat has rated this issue as having moderate security impact and has released an update to fix it in version 8.8.3.

An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

This update includes the following RPMs: binutils: * binutils-2.46.1-1.hum1 (aarch64, x86_64) * binutils-devel-2.46.1-1.hum1 (aarch64, x86_64) * binutils-gold-2.46.1-1.hum1 (aarch64, x86_64) * binutils-gprofng-2.46.1-1.hum1 (aarch64, x86_64) * binutils-2.46.1-1.hum1.src (src) Security Fix(es): binutils: * CVE-2025-11082 * CVE-2025-11083 * CVE-2026-3441 * CVE-2026-3442 * CVE-2026-4647 * CVE-2026-6845 * CVE-2026-6846

A moderate severity security vulnerability (CVE-2025-5244) exists in the GNU Binutils ld utility within Red Hat Enterprise Linux 10. The flaw involves a memory corruption issue in the elflink.c elf_gc_sweep function. This vulnerability affects multiple architectures and versions of Red Hat Enterprise Linux 10. A security update addressing this issue is available from Red Hat.