Commit: Fix CVE-2026-19582
Project / Subsystem
binutils / commit
Date
2026-09-02
Proposer
Nick Clifton <nickc@redhat.com>
Source type
public_inbox
Consensus
Proposed
Sentiment
8/10
Technical tradeoffs
- • Fixes a security vulnerability, improving robustness.
- • The chosen fix might be considered 'faffy' or overly complex for a low-probability issue.
- • Alternative solutions like `bfd_asprintf` were considered but potentially dismissed due to unstated reasons.
All attributes
- project
- binutils
- subsystem
- commit
- patch_id
- —
- discussion_id
- 87jyp49gon.fsf@redhat.com
- source_type
- public_inbox
- title
- Commit: Fix CVE-2026-19582
- headline
- Fix CVE-2026-19582: PE resource section buffer overflow
- tldr
- Fixes a buffer overflow in PE resource section parsing by using a dynamic string buffer.
- proposer
- Nick Clifton <nickc@redhat.com>
- consensus
- Proposed
- outcome
- committed
- sentiment_score
- 8
- technical_tradeoffs
-
- • Fixes a security vulnerability, improving robustness.
- • The chosen fix might be considered 'faffy' or overly complex for a low-probability issue.
- • Alternative solutions like `bfd_asprintf` were considered but potentially dismissed due to unstated reasons.
- series_id
- —
- series_role
- standalone
- series_parts
- []
- tags
-
- • security
- • cve
- • pe
- • buffer overflow
- • linker
- bugzilla_url
- —
- date
- 2026-09-02T00:00:00.000Z
Commit: Fix CVE-2026-19582
A security vulnerability (CVE-2026-19582) in binutils allowed a buffer overflow when parsing malformed PE files. The peXXigen.c:rsrc_sort_entries() function used a fixed-size buffer for error messages, which could be overflowed by crafted input. The fix replaces the static buffer with a dynamic rsrc_string structure to manage buffer space more safely, although the vulnerability is considered unlikely to be exploited in practice.