CVE-2026-90801GNU Binutils ld cache.c cache_bwrite buffer overflow

Beschreibung

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• VDB-403303 | GNU Binutils ld cache.c cache_bwrite buffer overflow vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory
• VDB-403303 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-requiredPermissions RequiredThird Party Advisory
• CVE-2026-90801 | CVE Analysis and Report third-party-advisoryPermissions RequiredThird Party AdvisoryVDB Entry
• Submit #920276 | GNU Binutils 2.47 (version date 20260726) Heap-based Buffer Overflow third-party-advisoryPermissions RequiredThird Party AdvisoryVDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=34442 issue-trackingExploitThird Party Advisory
• https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c… exploitExploitMitigationThird Party Advisory
• https://www.gnu.org/ broken-linkproductProduct