Security readout for executives and security teams
Plain-English summary
A malicious or malformed XCOFF object file can make affected GNU Binutils tools read beyond intended memory. Processing that file may crash a tool or reveal limited memory contents. The file must reach and be opened by a vulnerable local workflow, so this is primarily a developer, build-system, analysis, or file-processing risk rather than a remotely exploitable service flaw.
Executive priority
Treat this as a normal-priority remediation for developer tooling and build infrastructure, elevated where untrusted object files are processed automatically. It does not warrant emergency internet-edge response based on supplied evidence. Patch through vendor channels and confirm legacy RHEL systems are included in inventory.
Technical view
GNU Binutils BFD fails to validate an XCOFF relocation type before using it, causing an out-of-bounds read (CWE-125). CVSS 3.1 is 6.1: local attack vector, low complexity, no privileges, user interaction, limited confidentiality impact, high availability impact, and no integrity impact.
Likely exposure
Exposure is most likely where affected Red Hat packages process untrusted XCOFF files. Listed affected products include RHEL 6–8 packages, RHEL 10 mingw-binutils, and two Red Hat Hardened Images binutils-main builds. Several RHEL 9 and RHEL 10 packages are explicitly unaffected. Other distributions are not established by this bundle.
Exploitation context
The source bundle does not identify active exploitation, and the CVE is not listed as KEV. Exploitation requires a crafted XCOFF file to be processed by an affected tool. The documented outcomes are denial of service and limited information disclosure; there is no documented integrity impact or code execution.
Researcher notes
Do not generalize Red Hat package status to every Binutils deployment. The bundle establishes an out-of-bounds read in BFD's XCOFF relocation processing but provides no evidence of code execution or active exploitation. Exact corrected versions are not included here; consult the cited advisories and upstream issue for authoritative remediation details.
Mitigation direction
- Review the applicable Red Hat advisories and install vendor-provided corrected packages where available.
- Prioritize build, debugging, and file-analysis systems that accept XCOFF files from untrusted sources.
- Restrict untrusted XCOFF processing until affected packages are updated or vendor guidance confirms safety.
- Check vendor guidance for unsupported or extended-lifecycle RHEL releases before selecting remediation.
Validation and detection
- Inventory installed binutils, GDB, GCC Toolset, mingw-binutils, and Hardened Images package versions.
- Compare each product and package combination against Red Hat's affected and unaffected status.
- Identify automated workflows or users that process externally supplied XCOFF object files.
- After updating, verify installed builds against the applicable Red Hat advisory.
- Review relevant tool crashes for correlation with externally sourced XCOFF files.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-4647 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H1.84.2redhatVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Made public.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:33527CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:39022CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-4647CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2450302CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://sourceware.org/bugzilla/show_bug.cgi?id=33919CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.