# CVE-2026-90801: GNU Binutils ld heap buffer overflow in cache_bwrite

Source: https://junglewise.ai/threats/cve-2026-90801-gnu-binutils-ld-heap-buffer-overflow-in-cache-bwrite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90801 · Severity: medium · CVSS 5.3 · Published 2026-09-14

GNU Binutils ld is a critical linker tool used to combine compiled object files into executable programs. A heap buffer overflow vulnerability exists when processing malformed ELF object files with specific linker options, allowing local attackers to read beyond allocated memory boundaries, which could lead to information disclosure or denial of service.

Technologies: [Gnu Binutils](https://junglewise.ai/threats/technologies/binutils). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-90801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90801 being exploited in the wild.

**How severe is CVE-2026-90801?** Medium severity, with a CVSS score of 5.3, published 14 September 2026.

**Which products and versions are affected?** Gnu Binutils 2.47.

**Is there a fix for CVE-2026-90801?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90801 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-90801?** Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap buffer out-of-bounds read in the cache_bwrite function (bfd/cache.c:436) triggered when linking a malformed ELF object file with --gc-sections and -w options. The root cause is a size mismatch: the section-contents buffer is allocated based on the on-disk section size, but the write path attempts to write a larger nbytes value via fwrite(), reading past the end of the allocated region. The attack vector is local, requiring the attacker to provide a malformed ELF object file to ld. This is a recurrence of previously-reported bug 33457; the earlier fix was incomplete. Depending on heap allocation layout, this out-of-bounds read could potentially be exploited for information disclosure or escalation.

## Affected products

- GNU Binutils 2.47

## Timeline

- 2026-07-28: disclosed: Bug reported to Sourceware Bugzilla
- 2026-09-14: advisory: CVE-2026-90801 published on NVD
- 2026-08-09: other: Public exploit details published on GitHub

## References

- [https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c436)%20via%20malformed%20ELF%20with%20%60--gc-sections%20-w%60.md](https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c436)%20via%20malformed%20ELF%20with%20%60--gc-sections%20-w%60.md)
- [https://sourceware.org/bugzilla/show_bug.cgi?id=34442](https://sourceware.org/bugzilla/show_bug.cgi?id=34442)

## Related threats

- [GNU Binutils null pointer dereference in dynamic relocation allocation](https://junglewise.ai/threats/cve-2026-91782-gnu-binutils-null-pointer-dereference-in-dynamic-relocation)
- [GNU Binutils null pointer dereference in ELF section handler](https://junglewise.ai/threats/cve-2026-91781-gnu-binutils-null-pointer-dereference-in-elf-section-handler)
- [GNU Binutils null pointer dereference in ELF linker](https://junglewise.ai/threats/cve-2026-91780-gnu-binutils-null-pointer-dereference-in-elf-linker)
- [GNU Binutils null pointer dereference in eh_frame section offset](https://junglewise.ai/threats/cve-2026-91779-gnu-binutils-null-pointer-dereference-in-eh-frame-section-offset)
- [GNU Binutils memory corruption in ELF string table handling](https://junglewise.ai/threats/cve-2026-90831-gnu-binutils-memory-corruption-in-elf-string-table-handling)