CVE-2026-18220

Received Received - Intake

Out-of-Bounds Write in GNU Binutils DLX ELF Backend

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: redhat-SADP

Description

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation type number space is non-contiguous (basic types 0-6, extended types at 0x10000+), but the default case in the switch statement allows arbitrary index values to reach the array access. A specially crafted ELF/DLX object file can trigger this out-of-bounds write when processed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The vulnerability has been demonstrated to achieve arbitrary code execution via a File Stream Oriented Programming (FSOP) attack against glibc FILE structures (stderr), redirecting control flow to system(). Attack scenarios include CI/CD pipelines performing automated binary analysis, developer workstations running objdump/readelf on untrusted binaries, automated security scanning or malware analysis tools invoking binutils, and package build systems processing third-party code. Note: This vulnerability is only exploitable when binutils is built with the DLX backend enabled (typically via --enable-targets=all).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-18220

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	binutils	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds write vulnerability in the BFD library's DLX ELF backend in GNU binutils. The dlx_rtype_to_howto() function fails to validate attacker-controlled relocation type values before accessing an internal array, allowing arbitrary memory writes. Exploitation can lead to arbitrary code execution via FSOP attacks against glibc FILE structures.

Detection Guidance

Detecting this vulnerability requires checking if binutils is built with the DLX backend enabled and scanning for suspicious ELF files. Use 'objdump --version' to verify if DLX is supported. Inspect binutils packages for DLX backend inclusion. Scan systems for untrusted ELF files processed by binutils tools like objdump or readelf.

Impact Analysis

This vulnerability can impact you if you process untrusted ELF/DLX files using binutils tools like objdump, readelf, strip, ld, nm, or objcopy. Attackers can craft malicious files to execute arbitrary code on your system, potentially compromising your machine. Systems with DLX backend enabled are particularly at risk.

Compliance Impact

This vulnerability could lead to arbitrary code execution, potentially compromising systems handling sensitive data. For GDPR, it may result in unauthorized access to personal data, violating confidentiality requirements. For HIPAA, it could expose protected health information if exploited in systems processing medical data. Compliance may be impacted if the vulnerability is present in tools used to handle regulated data.

Mitigation Strategies

Disable the DLX backend in binutils by recompiling without --enable-targets=all. Update binutils to the latest patched version. Avoid processing untrusted ELF files with binutils tools. Implement input validation for ELF files in automated pipelines. Monitor for suspicious activity in binutils-consuming processes.

Hi! I’m here to help you understand CVE-2026-18220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70