Landing: 192afd3ce7c2
Project / Subsystem
binutils / bfd/pe
Date
2026-09-02
Author
Nick Clifton <nickc@sourceware.org>
Commit
192afd3ce7c2324cdbee2d4646df6cf1e9b6fd09
Source
public_inbox
Perf win
No
Breaking
No
All attributes
- project
- binutils
- subsystem
- bfd/pe
- patch_id
- —
- commit_hash
- 192afd3ce7c2324cdbee2d4646df6cf1e9b6fd09
- source_type
- public_inbox
- headline
- Fix CVE-2026-19582 - a potential buffer overflow in rsrc_resource_name.
- tldr
- BFD's PE resource-name printer now bounds-checks its output, closing a buffer-overflow CVE.
- author
- Nick Clifton <nickc@sourceware.org>
- outcome
- committed
- performance_win
- false
- breaking_change
- false
- series_id
- —
- series_parts
- []
- tags
-
- • security
- • CVE
- • PE/COFF
- • buffer-overflow
- • hardening
- discussion_id_link
- —
- bugzilla_pr
- —
- date
- 2026-09-02T00:00:00.000Z
The patch replaces unbounded sprintf calls in rsrc_print_name and related helpers with length-checked snprintf, preventing an attacker-controlled PE resource name from overwriting stack or heap buffers during objdump or linker invocations. The 116-line expansion adds two new helper functions, rsrc_string_print_str and rsrc_string_print_int, that track remaining buffer capacity and bail early if truncation would occur. Because malformed PE/COFF resource sections are common in the wild—both from fuzzing and legitimate but exotic toolchains—this fix defends a critical parsing path that every BFD consumer inherits.