{"id":"ECHO-2327-9760-e268","upstream":["CVE-2026-18220"],"severity":[],"modified":"2026-08-02T12:45:03.526Z","affected":[{"package":{"ecosystem":"Echo","name":"binutils"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.90.20260201+really2.45.50.20251201-1+e9"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-18220"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-18220"}],"withdrawn":"2026-08-02T12:45:03.526Z","summary":"Claimed out-of-bounds write in dlx_rtype_to_howto() (bfd/elf32-dlx.c),\nreached from elf32_dlx_info_to_howto_rel() via the relocation type of a\ncrafted ELF/DLX object.\n\nThe DLX backend is not built. dlx_elf32_be_vec is selected only by the\ndlx-*-elf target triple (bfd/config.bfd), and that vec is the sole trigger\nfor compiling elf32-dlx.lo (bfd/configure.ac); debian/rules passes an\nexplicit per-architecture --enable-targets list and never\n--enable-targets=all. Verified against the shipped amd64 and arm64 debs:\nlibbfd exports no dlx symbols, `objdump -b elf32-dlx` returns \"invalid bfd\ntarget\", `ld -m elf32dlx` is an unrecognised emulation, and a crafted\nEM_DLX (0x5aa5) object carrying relocation types past the end of the howto\ntable is claimed by the generic elf32-big backend, which reports\n\"architecture: UNKNOWN!\" and every relocation as UNKNOWN. The function is\nnever entered. Note that readelf prints DLX machine and relocation names\nfrom its own tables, independent of BFD, so its output is not evidence of\nthe backend being present.\n\nUpstream also rejects the finding on its merits, even with DLX enabled. On\nthe Red Hat bug that Debian's tracker carries as its only reference,\nmaintainer Andrew Burgess concludes \"I don't believe that this is actually\na bug\": DLX relocation types are a contiguous 0-9, not the non-contiguous\nspace with extended types at 0x10000+ that the advisory describes;\ndlx_rtype_to_howto() already rejects r_type >= R_DLX_max (10); and types\n6-9 have their own case arms, so the indexed access can only ever reach\n0-5 of the 6-entry dlx_elf_howto_table. Patrick Monnerat adds that the\nadvisory claims an out-of-bounds write while the procedure performs no\nindexed write at all. Both observations hold against the\n2.45.50.20251201 source.\n\nDebian marks it unimportant (binutils not covered by security support) and\nships no fix in any suite including forky/sid, so there is nothing to bump.\n"}