GNU Binutils CVE-2026-6846

Exploitation requires the target user to invoke GNU Binutils linker (ld) on a specially crafted XCOFF object file. XCOFF format support must be compiled into the binutils installation (default in RHEL distributions supporting cross-compilation). The attacker needs either local access to place the malicious file where a build process will consume it, or must socially engineer a developer into linking the file (e.g., disguised as a legitimate third-party library or dependency). Attack complexity is low (AC:L) once the file is presented to the linker, but practical exploitation is limited by XCOFF's niche usage-most Linux development targets ELF format, not XCOFF. Environments performing AIX/PowerPC cross-compilation or processing legacy AIX binaries face higher risk. User interaction (UI:R) is mandatory: the file must be explicitly linked via command-line or build script. No special privileges required (PR:N) beyond normal user access to run development tools. Scope is unchanged (S:U), meaning impact is confined to the security context of the user running the linker.

CVSS 7.8 (High) is appropriate given the potential for arbitrary code execution with high confidentiality, integrity, and availability impact. However, real-world exploitability is constrained by several factors that limit practical risk. The AV:L (local) vector requires the attacker to already have local access or social engineer a user. UI:R (user interaction required) means a developer must explicitly link the malicious XCOFF file using binutils. PR:N indicates no authentication needed once local access exists, but AC:L (low complexity) is somewhat misleading-successful exploitation requires crafting a valid-enough XCOFF structure to reach the vulnerable code path without triggering earlier validation failures. EPSS data not provided, but expected to be low given XCOFF's niche usage outside AIX environments. No CISA KEV listing indicates no confirmed active exploitation. Primary risk scenarios involve software build environments processing untrusted source distributions, supply chain attacks targeting development pipelines, or developers working with third-party XCOFF binaries. For most Linux environments not cross-compiling for AIX/PowerPC, exploitation conditions are rarely met, making this lower priority than the CVSS score alone suggests.

An attacker with local system access (or targeting a developer via social engineering) crafts a malicious XCOFF object file embedding heap overflow triggers in its section headers or symbol table. The attacker delivers this file as part of a seemingly legitimate software package, third-party library, or build dependency. When a developer runs 'ld' to link this object file with other components during software compilation, the linker's XCOFF parser overflows a heap buffer while processing the malformed structures. The attacker leverages this memory corruption to overwrite function pointers or control structures, redirecting execution to injected shellcode that runs with the developer's privileges, potentially compromising source code, credentials, or the build pipeline itself.