Executive brief
GNU Binutils ld is a critical linker tool used to combine compiled object files into executable programs. A heap buffer overflow vulnerability exists when processing malformed ELF object files with specific linker options, allowing local attackers to read beyond allocated memory boundaries, which could lead to information disclosure or denial of service.
Technical details
The vulnerability is a heap buffer out-of-bounds read in the cache_bwrite function (bfd/cache.c:436) triggered when linking a malformed ELF object file with --gc-sections and -w options. The root cause is a size mismatch: the section-contents buffer is allocated based on the on-disk section size, but the write path attempts to write a larger nbytes value via fwrite(), reading past the end of the allocated region. The attack vector is local, requiring the attacker to provide a malformed ELF object file to ld. This is a recurrence of previously-reported bug 33457; the earlier fix was incomplete. Depending on heap allocation layout, this out-of-bounds read could potentially be exploited for information disclosure or escalation.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-07-28: disclosed: Bug reported to Sourceware Bugzilla
- 2026-09-14: advisory: CVE-2026-90801 published on NVD
- 2026-08-09: other: Public exploit details published on GitHub