GNU binutils CVE-2026-19582

The victim must actively open or process a crafted PE (Portable Executable) file using a binutils tool (such as objdump, readelf, nm, or strip) on a system running binutils 2.46.1 or earlier - user interaction is mandatory and is the primary limiting factor. The attacker requires no system privileges to craft or deliver the malicious PE file (PR:N in CVSS), but must successfully deliver it to the victim through social engineering, supply-chain compromise, or a malicious repository. Exploitation is bounded to the victim's user-level permissions (S:U - no scope change to other system components). The vulnerability is not remotely triggerable without victim action; mass automated exploitation is not feasible given the UI:R requirement. No special non-default configuration of binutils is required - any invocation that parses a PE file is sufficient to trigger the overflow.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the threat model: local attack surface with low complexity and no attacker privileges required, but mandatory victim interaction - the victim must open a crafted PE file. Real-world risk is elevated in developer and security research environments where inspecting untrusted binaries is routine workflow. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified numerically; however, the absence of a CISA KEV listing and confirmed POC reduces immediate triage urgency compared to actively weaponized vulnerabilities. The primary realistic delivery mechanism is supply-chain compromise or social engineering - an attacker plants a malicious PE in a code repository, build artifact store, or email attachment. The scope-unchanged (S:U) metric means exploitation is bounded to the victim user's permissions, limiting privilege escalation potential but not lateral movement via compromised developer credentials.

An attacker publishes a maliciously crafted Windows PE binary to a public code repository, package registry, or sends it as an email attachment to a developer or security researcher. The victim downloads the file and inspects it using a binutils tool such as objdump -d or readelf, triggering the stack buffer overflow in the PE parser. The overflow overwrites the saved return address on the stack, redirecting execution to attacker-controlled shellcode and executing it with the victim's user privileges.