CVE-2026-18220: Out-of-Bounds Write in GNU Binutils BFD Library Leading to Arbitrary Code Execution

A critical out-of-bounds write vulnerability, identified as CVE-2026-18220, has been discovered in the BFD library's DLX ELF backend (specifically bfd/elf32-dlx.c) within GNU binutils. The dlx_rtype_to_howto() function, responsible for mapping ELF relocation types to internal howto structures, lacks adequate bounds checking. Attackers can manipulate relocation type values (via ELF32_R_TYPE(r_info)) in a specially crafted ELF/DLX object file to index out-of-bounds into the dlx_elf_howto_table[] array. This flaw can be exploited to achieve arbitrary code execution through a File Stream Oriented Programming (FSOP) attack targeting glibc FILE structures, ultimately redirecting control flow to system(). The vulnerability poses a significant risk to environments like CI/CD pipelines, developer workstations, automated security scanners, or package build systems that process untrusted binaries, particularly when binutils is compiled with the DLX backend enabled (e.g., via --enable-targets=all).

Attack Chain

1. An attacker crafts a malicious ELF/DLX object file containing carefully chosen relocation type values designed to trigger an out-of-bounds write.
2. The victim's system processes the untrusted, malicious ELF/DLX object file using a BFD-consuming tool such as objdump, readelf, strip, ld, nm, or objcopy.
3. During binary parsing, the vulnerable dlx_rtype_to_howto() function within the BFD library attempts to map the attacker-controlled relocation type values.
4. Due to insufficient bounds checking, the attacker's specially crafted relocation type values lead to an out-of-bounds index into the dlx_elf_howto_table[] array.
5. This out-of-bounds write is leveraged by the attacker to corrupt glibc FILE structures, initiating a File Stream Oriented Programming (FSOP) attack.
6. The FSOP attack redirects the program's control flow, specifically through stderr, to execute the system() function.
7. Arbitrary code specified by the attacker is executed on the compromised system, granting the attacker control over the vulnerable process and potentially the host system.

Impact

Successful exploitation of CVE-2026-18220 results in arbitrary code execution on affected systems. This can lead to complete compromise of developer workstations, CI/CD pipeline servers, automated security analysis tools, or package build systems that process untrusted or maliciously crafted ELF/DLX binaries. The severity is reflected by its CVSS v3.1 Base Score of 7.8 (High). Such compromise can enable attackers to exfiltrate sensitive intellectual property, inject malicious code into software build processes, or gain a foothold into critical development infrastructure, potentially leading to supply chain attacks.

Recommendation

• Patch CVE-2026-18220 immediately by updating GNU binutils to the latest secure version available from GNU or your operating system vendor.
• Restrict the processing of untrusted ELF/DLX binaries by BFD-consuming tools on critical systems such as CI/CD pipelines and developer workstations.
• Where binutils functionality is required, ensure the build configuration (--enable-targets=all) does not inadvertently enable the DLX backend if it is not explicitly needed.