A heap‑based buffer overflow caused by an out‑of‑bounds read in the bfd linker component of GNU Binutils can be triggered when a user processes a specially crafted XCOFF object file. Successful exploitation may expose sensitive information or result in the linker crashing, which causes an application‑level denial of service. The weakness is recognized as CWE‑125.

The vulnerability may affect systems that include Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4 and related GNU Binutils packages. No fixed version information is provided, so all installations of the affected component are considered at risk until a patch is applied.

The CVSS score of 6.1 indicates a medium severity overall. An EPSS score of less than 1 % suggests that the likelihood of exploitation is low at the current time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that a user intentionally or inadvertently load a malicious XCOFF file, meaning that the threat is limited to environments that allow such file processing. Nevertheless, the potential impact on confidentiality and availability warrants assessment and, where possible, mitigation.