Vulnerability-Lookup

osv-2026-973

Vulnerability from osv_ossfuzz

Published

2026-06-27 00:10

Modified

2026-06-29 20:05

Summary

Heap-buffer-overflow in bfd_getl16

Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528056360

Crash type: Heap-buffer-overflow READ 1
Crash state:
bfd_getl16
m32r_elf_generic_reloc
bfd_perform_relocation

References

URL

Type

https://bugs.chromium.org/p/oss-fuzz/issues/detai…

REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "fixed_range": "e17f386d7ffdd9604a0aad15a76606b846a2b9ed:11f57b156514211af29b93588c0fee2f8b3e66e4",
        "introduced_range": "80f2ae843a3c0968b34db51e4bb62a4610fa685d:db856d41004301b3a56438efd957ef5cabb91530"
      },
      "ecosystem_specific": {
        "severity": "MEDIUM"
      },
      "package": {
        "ecosystem": "OSS-Fuzz",
        "name": "binutils",
        "purl": "pkg:generic/binutils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "e814012b2b108743e21b7ef2799310a0f4e0a86d"
            },
            {
              "fixed": "11f57b156514211af29b93588c0fee2f8b3e66e4"
            },
            {
              "introduced": "9542d1b3a05477c415d870b7b652cdde75a5c8ea"
            }
          ],
          "repo": "git://sourceware.org/git/binutils-gdb.git",
          "type": "GIT"
        }
      ],
      "versions": [
        "binutils-2_44",
        "binutils-2_45",
        "binutils-2_45_1",
        "binutils-2_46",
        "binutils-2_46_1",
        "gdb-15.2-release",
        "gdb-16-branchpoint",
        "gdb-16.1-release",
        "gdb-16.2-release",
        "gdb-16.3-release",
        "gdb-17-branchpoint",
        "gdb-17.1-release",
        "gdb-17.2-release"
      ]
    }
  ],
  "details": "OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528056360\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nbfd_getl16\nm32r_elf_generic_reloc\nbfd_perform_relocation\n```\n",
  "id": "OSV-2026-973",
  "modified": "2026-06-29T20:05:30.805716Z",
  "published": "2026-06-27T00:10:11.183882Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=528056360"
    }
  ],
  "schema_version": "1.7.5",
  "summary": "Heap-buffer-overflow in bfd_getl16"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.