{"id":"CVE-2026-15003","title":"Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service","summary":"A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file…","severity":"medium","cvss":5.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"binutils-main","affected":["binutils-main (all versions)","binutils (all versions)","gcc-toolset-15-binutils (all versions)","gcc-toolset-16-binutils (all versions)","gdb (all versions)","mingw-binutils (all versions)","binutils (all versions)","binutils (all versions)","gdb (all versions)","binutils (all versions)","gcc-toolset-14-binutils (all versions)","gcc-toolset-14-gdb (all versions)","gcc-toolset-15-binutils (all versions)","gcc-toolset-15-gdb (all versions)","gdb (all versions)","mingw-binutils (all versions)","binutils (all versions)","gcc-toolset-14-binutils (all versions)","gcc-toolset-15-binutils (all versions)","gcc-toolset-16-binutils (all versions)","gdb (all versions)","mingw-binutils (all versions)","rhoai/odh-dashboard-rhel9","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-27T13:52:32.388455Z"},"published":"2026-07-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T07:39:32.341Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-15003","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:47171","label":"RHSA-2026:47171"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15003"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497805","label":"RHBZ#2497805"},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34053"}],"tags":["cve.org"],"epss":0.00151,"epssPercentile":0.04255,"ingestedAt":"2026-11-05T22:38:31.389Z","slug":"CVE-2026-15003","body":"## Overview\n\nA flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing.\n\n## Affected\n\n- `binutils-main (all versions)`\n- `binutils (all versions)`\n- `gcc-toolset-15-binutils (all versions)`\n- `gcc-toolset-16-binutils (all versions)`\n- `gdb (all versions)`\n- `mingw-binutils (all versions)`\n- `binutils (all versions)`\n- `binutils (all versions)`\n- `gdb (all versions)`\n- `binutils (all versions)`\n- `gcc-toolset-14-binutils (all versions)`\n- `gcc-toolset-14-gdb (all versions)`\n- `gcc-toolset-15-binutils (all versions)`\n- `gcc-toolset-15-gdb (all versions)`\n- `gdb (all versions)`\n- `mingw-binutils (all versions)`\n- `binutils (all versions)`\n- `gcc-toolset-14-binutils (all versions)`\n- `gcc-toolset-15-binutils (all versions)`\n- `gcc-toolset-16-binutils (all versions)`\n- `gdb (all versions)`\n- `mingw-binutils (all versions)`\n- `rhoai/odh-dashboard-rhel9`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":30.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}