Security readout for executives and security teams
Plain-English summary
A malicious XCOFF object file can corrupt memory when processed by affected Binutils-related tooling. An attacker must persuade a user or automated build process to handle the file. Successful exploitation could run unauthorized commands with that process’s permissions or interrupt service.
Executive priority
Prioritize remediation in CI, developer, and malware-analysis systems handling outside artifacts. The vulnerability has high potential impact but requires local file processing and user or workflow interaction. Accelerate action where untrusted objects are routinely processed; otherwise handle through the urgent patch cycle.
Technical view
CVE-2026-6846 is a CWE-122 heap-buffer overflow triggered while linking a specially crafted XCOFF object file. It is rated CVSS 3.1 7.8: local access, low complexity, no prior privileges, and user interaction required, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Confirmed affected Red Hat entries include specific Hardened Images binutils-main releases, RHEL 8 gdb and mingw-binutils, and RHEL 10 mingw-binutils. Numerous listed RHEL Binutils packages are marked unaffected. Exposure is greatest in developer, CI, analysis, or build environments that process untrusted object files.
Exploitation context
The supplied evidence does not establish active exploitation, and the CVE is not identified as being in KEV. Exploitation requires an affected tool to process an attacker-controlled XCOFF file, so untrusted source artifacts, build inputs, attachments, and analysis samples are the principal concern.
Researcher notes
Affectedness is package-specific and should not be generalized to every Binutils installation. The bundle confirms the XCOFF parsing condition and heap overflow but provides no exploitability details beyond possible code execution or denial of service. Use Red Hat’s VEX and advisories as the authoritative basis for package status.
Mitigation direction
- Review RHSA-2026:33527 and RHSA-2026:39022 for applicable vendor updates.
- Apply Red Hat-provided updates to confirmed affected packages and images.
- Restrict affected tooling from processing untrusted XCOFF object files until updated.
- Isolate build and analysis workloads that must handle externally supplied object files.
Validation and detection
- Inventory Binutils, GDB, MinGW Binutils, and Hardened Images across development and CI environments.
- Compare installed packages and image releases against Red Hat’s CVE and VEX status.
- Confirm applicable RHSA updates are installed using approved asset-management evidence.
- Identify workflows accepting object files from external or otherwise untrusted sources.
- Retest affected build and analysis workflows after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-6846 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9redhatCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- ADP timelineredhat-SADP
Reported to Red Hat.
- ADP timelineredhat-SADP
Made public.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-08T00:00:00.000Z: Reported to Red Hat.
- 2026-04-08T00:00:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:33527CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:39022CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-6846CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2460006CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6846.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.