Red HatCVE-2026-15003
Red Hat Enterprise Linux: out-of-bounds read
Medium5.6CVE-2026-15003 · Published Jul 27, 2026 · updated Sep 1, 2026
A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet | |
| all versions | No fix yet | |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 6 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-125
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 28 | Red Hat GStreamer: out-of-bounds read | Low3.3 | No fix yet |
| Jul 27 | Red Hat file-sgi plugin: integer overflow | Medium5.5 | No fix yet |
| Jul 27 | Red Hat file-fits plugin: integer overflow | High7.8 | No fix yet |
| Jul 27 | Red Hat file-icns plugin: out-of-bounds read | High7.1 | No fix yet |
| Jul 27 | Red Hat: insufficient authenticity check | High7.5 | No fix yet |
| Jul 27 | Red Hat OpenShift Virtualization 4: insecure direct object reference | High7.7 | No fix yet |