CVE-2026-18220

Name of the Vulnerable Software and Affected Versions GNU binutils (affected versions not specified)

Description An out-of-bounds write exists in the BFD library's DLX ELF backend within the bfd/elf32-dlx.c file. The dlx rtype to howto() function fails to properly validate relocation type values provided via ELF32 R TYPE(r info) before using them as an index for the dlx elf howto table[] array. Because the DLX relocation type number space is non-contiguous, the default case in the switch statement allows arbitrary values to cause an out-of-bounds write. This can be triggered by processing a specially crafted ELF/DLX object file using tools such as objdump, readelf, strip, ld, nm, or objcopy. The issue can lead to arbitrary code execution through File Stream Oriented Programming (FSOP), a technique that manipulates file stream structures to redirect control flow, specifically targeting glibc FILE structures like stderr to execute system(). This is only exploitable if binutils is compiled with the DLX backend enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.