Vulnerability Reportrust:1.96.0-slim-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker who can trick a user into processing a malicious file (e.g., running objdump/readelf/ld on untrusted input) could achieve arbitrary code execution or memory corruption, potentially compromising the build environment or developer machine. The risk is predominantly local and requires user interaction, so it is primarily a concern in CI/CD pipelines or developer workstations that analyze untrusted binaries. Note: CVE-2026-18220 only applies if binutils is built with the DLX backend enabled; a patched binutils (2.46 or later) resolves most of these issues. The base image itself is trusted and pinned by digest, so adopting a patched base or rebuilding with updated libbinutils is recommended. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.