In binutils version 2.46.1 and earlier a stack buffer overflow occurs in the rsrc_print_name function when processing a malicious PE file. The overflow writes beyond the bounds of a stack buffer, allowing an attacker to execute arbitrary code without direct interaction with the affected process. The flaw reveals a high severity vulnerability with a CVSS score of 7.8, meaning that exploitation could lead to full control of the machine running binutils.

Red Hat products including the Migration Toolkit for Containers, Red Hat Enterprise Linux from version 6 through 10, Red Hat Hardened Images, and Red‑Hat OpenShift Container Platform 4 are affected when they ship with binutils 2.46.1 or earlier. Any instance of these products that has that version of binutils installed and processes a crafted Portable Executable file is vulnerable.

The vulnerability does not require network connectivity; an attacker simply needs the ability to invoke binutils on a crafted PE file. Because the description provides no indication of remote triggers, the likely attack vector is local or local‑user exploitation. The EPSS score is unavailable, and the flaw is not yet cataloged in CISA KEV, but the CVSS rating signals a high risk. Users who must process unknown or untrusted files with binutils should treat this with the same urgency as a remote code execution flaw.