GNU binutils CVE-2026-18220

Exploitation requires (1) a binutils/BFD build with the DLX ELF backend compiled in - typically only present when configured with --enable-targets=all, which is not the default on most distributions and is the primary limiting factor; (2) a victim tool (objdump, readelf, strip, ld, nm, or objcopy) actually processing an attacker-supplied ELF/DLX object file, satisfying the CVSS UI:R user-interaction requirement; and (3) a crafted r_info encoding an out-of-range ELF32_R_TYPE relocation value that falls into the switch default case. Demonstrated code execution additionally relies on a glibc FILE-structure (FSOP) technique against stderr, so exploit reliability depends on the target's glibc layout and mitigations. Limiting factors: local attack vector (the file must reach the victim), the non-default DLX build gate, and the need for the victim to run a BFD tool on the untrusted file.

The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): local vector, no privileges, but required user interaction (a victim must run a binutils tool on the malicious file) with full CIA impact via code execution. The key risk modifier is not captured by raw CVSS - the code path only exists when binutils is built with the DLX backend, which is NOT the default for mainstream distributions, substantially narrowing real-world exploitability and arguably making practical complexity higher than AC:L implies. No EPSS score, KEV listing, or SSVC data was provided, so automatability and exploitation-status signals are unknown. There is no public exploit identified at time of analysis; the demonstrated FSOP code execution proves the flaw is weaponizable in principle but is distinct from confirmed active exploitation. Net: a genuine memory-corruption-to-RCE issue worth patching on developer, CI/CD, and build systems, but mass exploitation is constrained by the non-default DLX build requirement and the user-interaction prerequisite.

An attacker submits a malicious ELF/DLX object file to a target's repository, package feed, or malware-sample intake. When a CI/CD pipeline, analysis sandbox, or developer runs objdump or readelf on it, dlx_rtype_to_howto() performs an out-of-bounds write that, via an FSOP attack on glibc's stderr FILE structure, redirects control flow to system() and executes code in the tool's context. The vector is local with required user interaction, but binary-analysis automation makes that interaction routine and unattended.