GNU Binutils EUVD-2026-12194

Exploitation requires (1) a target system running a BFD-based tool such as the ld linker from vulnerable binutils, and (2) the victim being induced to process a specially crafted XCOFF-format object file (UI:R user interaction). The attack vector is local (AV:L): the attacker must get the malicious file onto the system and have it parsed by the toolchain, not reach it over a network. Limiting factors: it only triggers on the XCOFF code path (an AIX/PowerPC object format uncommon in ELF-based x86/ARM Linux builds), it cannot be triggered remotely without a victim action, and it yields information disclosure or a crash rather than code execution. No special authentication is needed (PR:N), but the dependence on user-initiated file processing substantially narrows real-world reach.

Signals are consistent and point to a moderate, not urgent, issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 7.1) confirms local attack vector with required user interaction-exploitation depends on a victim processing a malicious file, not on remote network reach. EPSS is essentially zero (0.01%, 2nd percentile), the CVE is not in CISA KEV, and no public exploit is identified, so there is no evidence of opportunistic or widespread exploitation. The impact is bounded to confidentiality (heap memory disclosure) and availability (process crash); there is no integrity impact (I:N) and no code execution claimed. The CVSS C:H rating is somewhat optimistic for a bounded OOB read-real-world disclosure is likely limited to adjacent heap contents rather than arbitrary secrets-so the practical confidentiality impact may be lower than the High rating implies. Net: prioritize as routine patching, elevated only for build/CI systems that link untrusted object files.

An attacker crafts a malicious XCOFF object file and delivers it to a developer or build system-e.g., as a dependency artifact, an emailed sample, or a contributed object in a CI job. When the victim runs ld (or another BFD-based tool) against the file, BFD reads past a heap allocation, leaking adjacent memory into output/error channels or crashing the linker. No public proof-of-concept is currently identified.