Skip to content
OpenAdvisories
Medium RHSA-2026:47171 9 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Jul 29, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 binutils 0:2.46.1-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 binutils-devel 0:2.46.1-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 binutils-gold 0:2.46.1-1.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 binutils-gprofng 0:2.46.1-1.1.hum1

Vulnerabilities 9

  • Medium 5.6
    CVE-2026-15003

    Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

    A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could ex…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-90801

    GNU Binutils ld cache.c cache_bwrite buffer overflow

    A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Wolfi
  • Medium 5.3
    CVE-2026-90803

    GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow

    A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An…

    GNU Binutils binutils binutils Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-90828

    GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference

    A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The atta…

    GNU Binutils binutils binutils Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-90829

    GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference

    A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs t…

    GNU Binutils binutils binutils Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-90830

    GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference

    A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed lo…

    GNU Binutils binutils binutils Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-90831

    GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption

    A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component ELF String Table. The manipulation results in memory corruption. The attack requires a local approach.…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Wolfi
  • Medium 4.8
    CVE-2026-90804

    GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow

    A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length…

    GNU Binutils binutils binutils Debian Ubuntu Wolfi
  • Medium 4.4
    CVE-2026-90802

    GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference

    A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to …

    GNU Binutils binutils binutils Debian Ubuntu Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-15003
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-90804
  • report
    https://access.redhat.com/security/cve/CVE-2026-90802
  • report
    https://access.redhat.com/security/cve/CVE-2026-90830
  • report
    https://access.redhat.com/security/cve/CVE-2026-90828
  • report
    https://access.redhat.com/security/cve/CVE-2026-90829
  • report
    https://access.redhat.com/security/cve/CVE-2026-90803
  • report
    https://access.redhat.com/security/cve/CVE-2026-90831
  • report
    https://access.redhat.com/security/cve/CVE-2026-90801
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47171.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497805
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-15003
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-15003
  • article
    https://sourceware.org/bugzilla/show_bug.cgi?id=34053
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-90801
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-90801
  • article
    https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c436)%20via%20malformed%20ELF%20with%20%60--gc-sections%20-w%60.md
  • article
    https://sourceware.org/bugzilla/show_bug.cgi?id=34442
  • article
    https://vuldb.com/cve/CVE-2026-90801
  • article
    https://vuldb.com/submit/920276
  • article
    https://vuldb.com/vuln/403303
  • article
    https://vuldb.com/vuln/403303/cti
  • article
    https://www.gnu.org/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533185
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-90802
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-90802
  • article
    https://github.com/r1ck9-2q/cve_summit/blob/main/SEGV%20in%20%60bfd_putl64%60%20(bfdlibbfd.c989)%20during%20relocation%20output%20via%20malformed%20ELF.md
  • article
    https://sourceware.org/bugzilla/show_bug.cgi?id=34443
  • article
    https://vuldb.com/cve/CVE-2026-90802
  • article
    https://vuldb.com/submit/920277
  • article
    https://vuldb.com/vuln/403304
  • article
    https://vuldb.com/vuln/403304/cti
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533196
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-90803
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-90803
  • article
    https://github.com/r1ck9-2q/cve_summit/blob/main/Heap%20OOB%20readwrite%20and%20SEGV%20in%20%60elf_x86_64_relocate_section%60%20(bfdelf64-x86-64.c4530%20%204835)%20via%20malformed%20relocation.md