RHSA-2026:7098

Vulnerability from csaf_redhat - Published: 2026-04-08 14:43 - Updated: 2026-04-19 19:35
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-11081

An out of bounds read flaw has been discovered in GNU bin utilities. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11082

A head based buffer overflow flaw has been discovered in GNU bin utilities. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-209 - Generation of Error Message Containing Sensitive Information
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11083

A head based buffer overflow flaw has been discovered in GNU bin utilities. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-787 - Out-of-bounds Write
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11412

A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the bfd_elf_gc_record_vtentry function in the bfd/elflink.c file due to a missing sanity check, causing a crash and resulting in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11413

A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds write in the bfd_putl64 function in the bfd/libbfd.c file due to an improper check, causing a crash and resulting in a denial of service.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-787 - Out-of-bounds Write
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11414

A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the get_link_hash_entry function in the bfd/elflink.c file due to an improper check, causing a crash and resulting in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11494

An out of bounds read flaw has been discovered in the GNU Binutils package. The impacted function is _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11495

A heap based buffer overflow flaw has been discovered in the GNU Binutils package. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-805 - Buffer Access with Incorrect Length Value
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11839

An uncheck return value flaw has been discovered in the GNU binutils program. This flaw exists in the `tg_tag_type` function of the file prdbg.c and exploitation of this flaw may lead to a program crash.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-252 - Unchecked Return Value
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-11840

An out of bounds read flaw has been discovered in GNU binutils. The `vfinfo` function in the `ldmisc.c` file. Exploitation of this flaw requires local access and may cause a program crash.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-66861

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger an out-of-bounds read in the d_unqualified_name function in the cp-demangle.c file, causing a crash and resulting in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-66862

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a heap-based buffer over-read in the gnu_special function in the cplus-dem.c file, causing a crash and resulting in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-66863

A flaw was found in BinUtils. Attackers can exploit this vulnerability by providing a specially crafted Portable Executable (PE) file. This can lead to a denial of service, making the affected application unavailable.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround To reduce the risk of exploitation, users should avoid processing Portable Executable (PE) files from untrusted or unverified sources with BinUtils tools. Limiting the exposure of BinUtils to untrusted input can help prevent denial of service attacks.
CVE-2025-66864

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a NULL pointer dereference in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-476 - NULL Pointer Dereference
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-66865

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a stack overflow in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-121 - Stack-based Buffer Overflow
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-66866

A flaw was found in BinUtils. An attacker can exploit a vulnerability in the `d_abi_tags` function within the `cp-demangle.c` file by providing a specially crafted Portable Executable (PE) file. This can lead to a Denial of Service (DoS), making the affected application unavailable to legitimate users.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround To mitigate this issue, users should avoid processing untrusted Portable Executable (PE) files with applications linked against BinUtils. Restricting the source of PE files to trusted origins can reduce the attack surface.
CVE-2025-69645

A flaw was found in binutils, specifically in the `objdump` utility. A local attacker can exploit this vulnerability by providing a specially crafted binary file containing malformed DWARF (Debugging With Attributed Record Formats) debug information. This can lead to a logic error during the processing of DWARF compilation units, causing the `objdump` utility to crash and resulting in a denial of service.

2.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-69646

A flaw was found in binutils. A local attacker can exploit this vulnerability by supplying a malicious input file containing malformed DWARF debug_rnglists data. This can cause the objdump tool to enter an unbounded logging loop, leading to excessive CPU and I/O usage and preventing analysis completion. This issue results in a Denial of Service (DoS).

2.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-606 - Unchecked Input for Loop Condition
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-69647

A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF loclists data with the readelf program can trigger an infinite loop and result in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround To mitigate this vulnerability, do not process untrusted, unverified or externally supplied ELF binaries with the readelf program.
CVE-2025-69648

A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF .debug_rnglists data with the readelf program can trigger an infinite loop and result in a denial of service.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7098
Workaround To mitigate this vulnerability, do not process untrusted, unverified or externally supplied ELF binaries with the readelf program.
References
https://access.redhat.com/errata/RHSA-2026:7098 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2025-69645 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2025-11083 external
https://access.redhat.com/security/cve/CVE-2025-11082 external
https://access.redhat.com/security/cve/CVE-2025-11081 external
https://access.redhat.com/security/cve/CVE-2025-11840 external
https://access.redhat.com/security/cve/CVE-2025-11839 external
https://access.redhat.com/security/cve/CVE-2025-11495 external
https://access.redhat.com/security/cve/CVE-2025-11494 external
https://access.redhat.com/security/cve/CVE-2025-11414 external
https://access.redhat.com/security/cve/CVE-2025-11413 external
https://access.redhat.com/security/cve/CVE-2025-11412 external
https://access.redhat.com/security/cve/CVE-2025-66866 external
https://access.redhat.com/security/cve/CVE-2025-66864 external
https://access.redhat.com/security/cve/CVE-2025-66862 external
https://access.redhat.com/security/cve/CVE-2025-66863 external
https://access.redhat.com/security/cve/CVE-2025-66861 external
https://access.redhat.com/security/cve/CVE-2025-66865 external
https://access.redhat.com/security/cve/CVE-2025-69648 external
https://access.redhat.com/security/cve/CVE-2025-69647 external
https://access.redhat.com/security/cve/CVE-2025-69646 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-11081 self
https://bugzilla.redhat.com/show_bug.cgi?id=2399944 external
https://www.cve.org/CVERecord?id=CVE-2025-11081 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11081 external
https://github.com/user-attachments/files/2062335… external
https://sourceware.org/bugzilla/show_bug.cgi?id=33406 external
https://sourceware.org/bugzilla/show_bug.cgi?id=3… external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?ctiid.326122 external
https://vuldb.com/?id.326122 external
https://vuldb.com/?submit.661275 external
https://www.gnu.org/ external
https://access.redhat.com/security/cve/CVE-2025-11082 self
https://bugzilla.redhat.com/show_bug.cgi?id=2399943 external
https://www.cve.org/CVERecord?id=CVE-2025-11082 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11082 external
https://sourceware.org/bugzilla/attachment.cgi?id=16358 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33464 external
https://sourceware.org/bugzilla/show_bug.cgi?id=3… external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?ctiid.326123 external
https://vuldb.com/?id.326123 external
https://vuldb.com/?submit.661276 external
https://access.redhat.com/security/cve/CVE-2025-11083 self
https://bugzilla.redhat.com/show_bug.cgi?id=2399948 external
https://www.cve.org/CVERecord?id=CVE-2025-11083 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11083 external
https://sourceware.org/bugzilla/attachment.cgi?id=16353 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33457 external
https://sourceware.org/bugzilla/show_bug.cgi?id=3… external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?ctiid.326124 external
https://vuldb.com/?id.326124 external
https://vuldb.com/?submit.661277 external
https://access.redhat.com/security/cve/CVE-2025-11412 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402425 external
https://www.cve.org/CVERecord?id=CVE-2025-11412 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11412 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33452 external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?id.327348 external
https://access.redhat.com/security/cve/CVE-2025-11413 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402423 external
https://www.cve.org/CVERecord?id=CVE-2025-11413 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11413 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33456 external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?id.327349 external
https://access.redhat.com/security/cve/CVE-2025-11414 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402424 external
https://www.cve.org/CVERecord?id=CVE-2025-11414 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11414 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33450 external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?id.327350 external
https://access.redhat.com/security/cve/CVE-2025-11494 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402559 external
https://www.cve.org/CVERecord?id=CVE-2025-11494 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11494 external
https://sourceware.org/bugzilla/attachment.cgi?id=16389 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33499 external
https://sourceware.org/bugzilla/show_bug.cgi?id=3… external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?ctiid.327619 external
https://vuldb.com/?id.327619 external
https://vuldb.com/?submit.668281 external
https://access.redhat.com/security/cve/CVE-2025-11495 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402584 external
https://www.cve.org/CVERecord?id=CVE-2025-11495 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11495 external
https://sourceware.org/bugzilla/attachment.cgi?id=16393 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33502 external
https://sourceware.org/bugzilla/show_bug.cgi?id=3… external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://vuldb.com/?ctiid.327620 external
https://vuldb.com/?id.327620 external
https://vuldb.com/?submit.668290 external
https://access.redhat.com/security/cve/CVE-2025-11839 self
https://bugzilla.redhat.com/show_bug.cgi?id=2404439 external
https://www.cve.org/CVERecord?id=CVE-2025-11839 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11839 external
https://sourceware.org/bugzilla/attachment.cgi?id=16344 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33448 external
https://vuldb.com/?ctiid.328774 external
https://vuldb.com/?id.328774 external
https://vuldb.com/?submit.661279 external
https://access.redhat.com/security/cve/CVE-2025-11840 self
https://bugzilla.redhat.com/show_bug.cgi?id=2404481 external
https://www.cve.org/CVERecord?id=CVE-2025-11840 external
https://nvd.nist.gov/vuln/detail/CVE-2025-11840 external
https://sourceware.org/bugzilla/attachment.cgi?id=16351 external
https://sourceware.org/bugzilla/attachment.cgi?id=16357 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33455 external
https://vuldb.com/?ctiid.328775 external
https://vuldb.com/?id.328775 external
https://vuldb.com/?submit.661281 external
https://access.redhat.com/security/cve/CVE-2025-66861 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425823 external
https://www.cve.org/CVERecord?id=CVE-2025-66861 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66861 external
https://github.com/caozhzh/CRGF-Vul/blob/main/cxx… external
https://access.redhat.com/security/cve/CVE-2025-66862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425825 external
https://www.cve.org/CVERecord?id=CVE-2025-66862 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66862 external
https://github.com/caozhzh/CRGF-Vul/blob/main/cxx… external
https://access.redhat.com/security/cve/CVE-2025-66863 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425824 external
https://www.cve.org/CVERecord?id=CVE-2025-66863 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66863 external
https://github.com/caozhzh/CRGF-Vul/blob/main/cxx… external
https://access.redhat.com/security/cve/CVE-2025-66864 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425827 external
https://www.cve.org/CVERecord?id=CVE-2025-66864 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66864 external
https://github.com/caozhzh/CRGF-Vul/blob/main/cxx… external
https://access.redhat.com/security/cve/CVE-2025-66865 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425822 external
https://www.cve.org/CVERecord?id=CVE-2025-66865 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66865 external
https://github.com/caozhzh/CRGF-Vul/blob/main/cxx… external
https://access.redhat.com/security/cve/CVE-2025-66866 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425830 external
https://www.cve.org/CVERecord?id=CVE-2025-66866 external
https://nvd.nist.gov/vuln/detail/CVE-2025-66866 external
https://github.com/caozhzh/CRGF-Vul/blob/main/cxx… external
https://access.redhat.com/security/cve/CVE-2025-69645 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445261 external
https://www.cve.org/CVERecord?id=CVE-2025-69645 external
https://nvd.nist.gov/vuln/detail/CVE-2025-69645 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33637 external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://access.redhat.com/security/cve/CVE-2025-69646 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445264 external
https://www.cve.org/CVERecord?id=CVE-2025-69646 external
https://nvd.nist.gov/vuln/detail/CVE-2025-69646 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33638 external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://access.redhat.com/security/cve/CVE-2025-69647 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445773 external
https://www.cve.org/CVERecord?id=CVE-2025-69647 external
https://nvd.nist.gov/vuln/detail/CVE-2025-69647 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33640 external
https://sourceware.org/git/gitweb.cgi?p=binutils-… external
https://access.redhat.com/security/cve/CVE-2025-69648 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445774 external
https://www.cve.org/CVERecord?id=CVE-2025-69648 external
https://nvd.nist.gov/vuln/detail/CVE-2025-69648 external
https://sourceware.org/bugzilla/show_bug.cgi?id=33641 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7098",
        "url": "https://access.redhat.com/errata/RHSA-2026:7098"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69645",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69645"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11083",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11083"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11082",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11082"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11081",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11081"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11840",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11840"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11839",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11839"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11495",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11495"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11494",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11494"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11414",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11414"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11413",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11413"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-11412",
        "url": "https://access.redhat.com/security/cve/CVE-2025-11412"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66866",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66866"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66864",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66864"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66862",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66863",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66863"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66861",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66861"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66865",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66865"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69648",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69648"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69647",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69647"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69646",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69646"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7098.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-04-19T19:35:53+00:00",
      "generator": {
        "date": "2026-04-19T19:35:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:7098",
      "initial_release_date": "2026-04-08T14:43:05+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T14:43:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-18T20:01:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-19T19:35:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binutils-main@aarch64",
                "product": {
                  "name": "binutils-main@aarch64",
                  "product_id": "binutils-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/binutils@2.45.1-5.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binutils-main@src",
                "product": {
                  "name": "binutils-main@src",
                  "product_id": "binutils-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/binutils@2.45.1-5.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "binutils-main@x86_64",
                "product": {
                  "name": "binutils-main@x86_64",
                  "product_id": "binutils-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/binutils@2.45.1-5.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binutils-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:binutils-main@aarch64"
        },
        "product_reference": "binutils-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binutils-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:binutils-main@src"
        },
        "product_reference": "binutils-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "binutils-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:binutils-main@x86_64"
        },
        "product_reference": "binutils-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11081",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-09-27T23:00:53.878653+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2399944"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out of bounds read flaw has been discovered in GNU bin utilities. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11081"
        },
        {
          "category": "external",
          "summary": "RHBZ#2399944",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2399944"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11081",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11081"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11081",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11081"
        },
        {
          "category": "external",
          "summary": "https://github.com/user-attachments/files/20623354/hdf5_crash_3.txt",
          "url": "https://github.com/user-attachments/files/20623354/hdf5_crash_3.txt"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33406",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33406"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33406#c2",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33406#c2"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.326122",
          "url": "https://vuldb.com/?ctiid.326122"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.326122",
          "url": "https://vuldb.com/?id.326122"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.661275",
          "url": "https://vuldb.com/?submit.661275"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-09-27T22:02:08.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "binutils: GNU Binutils out-of-bounds read"
    },
    {
      "cve": "CVE-2025-11082",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "discovery_date": "2025-09-27T23:00:49.860051+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2399943"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A head based buffer overflow flaw has been discovered in GNU bin utilities. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker heap-based overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Moderate as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the impact of this flaw will be restricted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11082"
        },
        {
          "category": "external",
          "summary": "RHBZ#2399943",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2399943"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11082",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11082"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11082",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11082"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16358",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16358"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33464",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33464"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ea1a0737c7692737a644af0486b71e4a392cbca8"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.326123",
          "url": "https://vuldb.com/?ctiid.326123"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.326123",
          "url": "https://vuldb.com/?id.326123"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.661276",
          "url": "https://vuldb.com/?submit.661276"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-09-27T22:32:09.144000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "binutils: GNU Binutils Linker heap-based overflow"
    },
    {
      "cve": "CVE-2025-11083",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2025-09-28T00:01:07.638629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2399948"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A head based buffer overflow flaw has been discovered in GNU bin utilities. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker heap-based overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Moderate as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the impact of this flaw will be restricted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11083"
        },
        {
          "category": "external",
          "summary": "RHBZ#2399948",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2399948"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11083",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11083"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11083",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11083"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16353",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16353"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33457",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33457"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33457#c1",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33457#c1"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9ca499644a21ceb3f946d1c179c38a83be084490"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.326124",
          "url": "https://vuldb.com/?ctiid.326124"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.326124",
          "url": "https://vuldb.com/?id.326124"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.661277",
          "url": "https://vuldb.com/?submit.661277"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-09-27T23:02:08.428000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "binutils: GNU Binutils Linker heap-based overflow"
    },
    {
      "cve": "CVE-2025-11412",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-10-07T23:00:58.499698+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402425"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the bfd_elf_gc_record_vtentry function in the bfd/elflink.c file due to a missing sanity check, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with ld-new. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11412"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402425",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402425"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11412",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11412"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11412",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11412"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33452",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33452"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.327348",
          "url": "https://vuldb.com/?id.327348"
        }
      ],
      "release_date": "2025-10-07T22:02:08.093000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds"
    },
    {
      "cve": "CVE-2025-11413",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2025-10-07T23:00:50.499970+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds write in the bfd_putl64 function in the bfd/libbfd.c file due to an improper check, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds write is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with ld-new. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11413"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11413",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11413"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11413",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11413"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33456",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33456"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.327349",
          "url": "https://vuldb.com/?id.327349"
        }
      ],
      "release_date": "2025-10-07T22:02:12.368000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds"
    },
    {
      "cve": "CVE-2025-11414",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-10-07T23:00:54.553467+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402424"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the get_link_hash_entry function in the bfd/elflink.c file due to an improper check, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with ld-new. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11414"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402424",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402424"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11414",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11414"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11414",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11414"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33450",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33450"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aeaaa9af6359c8e394ce9cf24911fec4f4d23703",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aeaaa9af6359c8e394ce9cf24911fec4f4d23703"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.327350",
          "url": "https://vuldb.com/?id.327350"
        }
      ],
      "release_date": "2025-10-07T22:32:07.740000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds"
    },
    {
      "cve": "CVE-2025-11494",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-10-08T20:01:03.813329+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402559"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out of bounds read flaw has been discovered in the GNU Binutils package. The impacted function is _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11494"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402559",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402559"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11494",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11494"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11494",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11494"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16389",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16389"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33499",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33499"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.327619",
          "url": "https://vuldb.com/?ctiid.327619"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.327619",
          "url": "https://vuldb.com/?id.327619"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.668281",
          "url": "https://vuldb.com/?submit.668281"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-10-08T19:32:07.225000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils Linker out-of-bounds read"
    },
    {
      "cve": "CVE-2025-11495",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2025-10-08T21:01:22.754685+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402584"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap based buffer overflow flaw has been discovered in the GNU Binutils package. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils Linker heap-based overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11495"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402584",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402584"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11495",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11495"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11495",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11495"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16393",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16393"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33502",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33502"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33502#c3",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33502#c3"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.327620",
          "url": "https://vuldb.com/?ctiid.327620"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.327620",
          "url": "https://vuldb.com/?id.327620"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.668290",
          "url": "https://vuldb.com/?submit.668290"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-10-08T20:02:07.807000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils Linker heap-based overflow"
    },
    {
      "cve": "CVE-2025-11839",
      "cwe": {
        "id": "CWE-252",
        "name": "Unchecked Return Value"
      },
      "discovery_date": "2025-10-16T15:01:11.828720+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2404439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An uncheck return value flaw has been discovered in the GNU binutils program. This flaw exists in the `tg_tag_type` function of the file prdbg.c and exploitation of this flaw may lead to a program crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils prdbg.c tg_tag_type return value",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11839"
        },
        {
          "category": "external",
          "summary": "RHBZ#2404439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11839"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16344",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16344"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33448",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33448"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.328774",
          "url": "https://vuldb.com/?ctiid.328774"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.328774",
          "url": "https://vuldb.com/?id.328774"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.661279",
          "url": "https://vuldb.com/?submit.661279"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-10-16T14:02:13.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils prdbg.c tg_tag_type return value"
    },
    {
      "cve": "CVE-2025-11840",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-10-16T16:01:52.998172+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2404481"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out of bounds read flaw has been discovered in GNU binutils. The `vfinfo` function in the `ldmisc.c` file. Exploitation of this flaw requires local access and may cause a program crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: GNU Binutils out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-11840"
        },
        {
          "category": "external",
          "summary": "RHBZ#2404481",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404481"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-11840",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-11840"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11840",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11840"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16351",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16351"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/attachment.cgi?id=16357",
          "url": "https://sourceware.org/bugzilla/attachment.cgi?id=16357"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33455",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33455"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.328775",
          "url": "https://vuldb.com/?ctiid.328775"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.328775",
          "url": "https://vuldb.com/?id.328775"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.661281",
          "url": "https://vuldb.com/?submit.661281"
        },
        {
          "category": "external",
          "summary": "https://www.gnu.org/",
          "url": "https://www.gnu.org/"
        }
      ],
      "release_date": "2025-10-16T15:32:11.651000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: GNU Binutils out-of-bounds read"
    },
    {
      "cve": "CVE-2025-66861",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-12-29T17:01:12.281547+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger an out-of-bounds read in the d_unqualified_name function in the cp-demangle.c file, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with cxxfilt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66861"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66861",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66861"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66861",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66861"
        },
        {
          "category": "external",
          "summary": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash1.md",
          "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash1.md"
        }
      ],
      "release_date": "2025-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: out-of-bounds read in d_unqualified_name() in cp-demangle.c"
    },
    {
      "cve": "CVE-2025-66862",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-12-29T17:01:21.267481+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a heap-based buffer over-read in the gnu_special function in the cplus-dem.c file, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this heap-based buffer over-read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with cxxfilt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66862"
        },
        {
          "category": "external",
          "summary": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash3.md",
          "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash3.md"
        }
      ],
      "release_date": "2025-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: heap-based buffer over-read in gnu_special() in cplus-dem.c"
    },
    {
      "cve": "CVE-2025-66863",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-12-29T17:01:17.562135+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BinUtils. Attackers can exploit this vulnerability by providing a specially crafted Portable Executable (PE) file. This can lead to a denial of service, making the affected application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: BinUtils: Denial of Service via crafted PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat products. The flaw in BinUtils allows for a denial of service when processing a specially crafted Portable Executable (PE) file. For a successful attack to take place the user needs to be tricked to process the maliciously crafted PE binary using the affected program. The consequences of a successful attack is also restricted to the single process instance reading the malicious file and does not have a system-wide effect, presenting a Low impact in the availability criteria.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66863"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66863",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66863"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66863",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66863"
        },
        {
          "category": "external",
          "summary": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash2.md",
          "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash2.md"
        }
      ],
      "release_date": "2025-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "To reduce the risk of exploitation, users should avoid processing Portable Executable (PE) files from untrusted or unverified sources with BinUtils tools. Limiting the exposure of BinUtils to untrusted input can help prevent denial of service attacks.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: BinUtils: Denial of Service via crafted PE file"
    },
    {
      "cve": "CVE-2025-66864",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2025-12-29T17:01:30.656433+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a NULL pointer dereference in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this NULL pointer dereference is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with cxxfilt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66864"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66864",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66864"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66864",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66864"
        },
        {
          "category": "external",
          "summary": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash5.md",
          "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash5.md"
        }
      ],
      "release_date": "2025-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: NULL pointer dereference in d_print_comp_inner() in cp-demangle.c"
    },
    {
      "cve": "CVE-2025-66865",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2025-12-29T17:01:00.492229+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a stack overflow in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: stack overflow in d_print_comp_inner() in cp-demangle.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this stack overflow is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with cxxfilt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66865"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66865",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66865"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66865",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66865"
        },
        {
          "category": "external",
          "summary": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash4.md",
          "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash4.md"
        }
      ],
      "release_date": "2025-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: stack overflow in d_print_comp_inner() in cp-demangle.c"
    },
    {
      "cve": "CVE-2025-66866",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-12-29T17:01:51.937961+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BinUtils. An attacker can exploit a vulnerability in the `d_abi_tags` function within the `cp-demangle.c` file by providing a specially crafted Portable Executable (PE) file. This can lead to a Denial of Service (DoS), making the affected application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: BinUtils: Denial of Service via crafted PE file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat products. The flaw in BinUtils allows for a denial of service when processing a specially crafted Portable Executable (PE) file. For a successful attack to take place the user needs to be tricked to process the maliciously crafted PE binary using the affected program. The consequences of a successful attack is also restricted to the single process instance reading the malicious file and does not have a system-wide effect, presenting a Low impact in the availability criteria.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66866"
        },
        {
          "category": "external",
          "summary": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash6.md",
          "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash6.md"
        }
      ],
      "release_date": "2025-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid processing untrusted Portable Executable (PE) files with applications linked against BinUtils. Restricting the source of PE files to trusted origins can reduce the attack surface.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: BinUtils: Denial of Service via crafted PE file"
    },
    {
      "cve": "CVE-2025-69645",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-03-06T18:01:04.945128+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445261"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils, specifically in the `objdump` utility. A local attacker can exploit this vulnerability by providing a specially crafted binary file containing malformed DWARF (Debugging With Attributed Record Formats) debug information. This can lead to a logic error during the processing of DWARF compilation units, causing the `objdump` utility to crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: Binutils objdump: Denial of Service via crafted DWARF debug information",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69645"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445261",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445261"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69645",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69645"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69645",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69645"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33637",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33637"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cdb728d4da6184631989b192f1022c219dea7677",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cdb728d4da6184631989b192f1022c219dea7677"
        }
      ],
      "release_date": "2026-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: Binutils objdump: Denial of Service via crafted DWARF debug information"
    },
    {
      "cve": "CVE-2025-69646",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-03-06T18:01:14.636591+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445264"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. A local attacker can exploit this vulnerability by supplying a malicious input file containing malformed DWARF debug_rnglists data. This can cause the objdump tool to enter an unbounded logging loop, leading to excessive CPU and I/O usage and preventing analysis completion. This issue results in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69646"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445264",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445264"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69646",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69646"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69646",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69646"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33638",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33638"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33"
        }
      ],
      "release_date": "2026-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: Binutils: Denial of Service via malformed DWARF debug_rnglists data"
    },
    {
      "cve": "CVE-2025-69647",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-03-09T15:01:20.301341+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445773"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF loclists data with the readelf program can trigger an infinite loop and result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this infinite loop is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with readelf. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69647"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445773",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445773"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69647",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69647"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69647",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69647"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33640",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33640"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=455446bbdc8675f34808187de2bbad4682016ff7"
        }
      ],
      "release_date": "2026-03-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not process untrusted, unverified or externally supplied ELF binaries with the readelf program.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data"
    },
    {
      "cve": "CVE-2025-69648",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-03-09T15:01:24.793435+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445774"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF .debug_rnglists data with the readelf program can trigger an infinite loop and result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this infinite loop is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with readelf. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:binutils-main@aarch64",
          "Red Hat Hardened Images:binutils-main@src",
          "Red Hat Hardened Images:binutils-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69648"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445774",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445774"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69648",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69648"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69648",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69648"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33641",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33641"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33",
          "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33"
        }
      ],
      "release_date": "2026-03-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T14:43:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7098"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not process untrusted, unverified or externally supplied ELF binaries with the readelf program.",
          "product_ids": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:binutils-main@aarch64",
            "Red Hat Hardened Images:binutils-main@src",
            "Red Hat Hardened Images:binutils-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.