Is CVE-2026-90803 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90803 being exploited in the wild.

How severe is CVE-2026-90803?

Medium severity, with a CVSS score of 5.3, published 14 September 2026.

Is there a fix for CVE-2026-90803?

A patch was published on 2026-09-14: Fix available in version 2.48, commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90803 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-90803?

Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90803: GNU Binutils buffer overflow in elf_x86_64_relocate_section

CVE-2026-90803 · Severity: medium · CVSS 5.3 · Published 2026-09-14

GNU Binutils is a collection of binary tools used by developers and build systems to process compiled code. A buffer overflow vulnerability in the linker's ELF x86-64 relocation handler allows a local attacker to cause a denial of service or potentially execute arbitrary code by providing a malformed binary file during linking.

Technologies: Gnu Binutils. Vendors: Gnu.

Quick answers

Is CVE-2026-90803 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90803 being exploited in the wild.
How severe is CVE-2026-90803?: Medium severity, with a CVSS score of 5.3, published 14 September 2026.
Which products and versions are affected?: Gnu Binutils 2.47.
Is there a fix for CVE-2026-90803?: A patch was published on 2026-09-14: Fix available in version 2.48, commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90803 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-90803?: Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a buffer overflow in the elf_x86_64_relocate_section function within bfd/elf64-x86-64.c, triggered by improper handling of the relocation offset (roff) argument when processing malformed ELF relocations. The attack vector is local; an attacker must convince a developer or build system to process a specially crafted ELF binary file. Exploitation results in out-of-bounds heap read/write and potential segmentation faults. The fix is available in GNU Binutils 2.48 (commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b), and upgrading is the recommended remediation.

Affected products

GNU Binutils 2.47

Timeline

2026-09-14: disclosed
2026-09-14: patched: Fix available in version 2.48, commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.