CVE-2026-90801GNU Binutils ld cache.c cache_bwrite buffer overflow

Description

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• VDB-403303 | GNU Binutils ld cache.c cache_bwrite buffer overflow vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory
• VDB-403303 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-requiredPermissions RequiredThird Party Advisory
• CVE-2026-90801 | CVE Analysis and Report third-party-advisoryPermissions RequiredThird Party AdvisoryVDB Entry
• Submit #920276 | GNU Binutils 2.47 (version date 20260726) Heap-based Buffer Overflow third-party-advisoryPermissions RequiredThird Party AdvisoryVDB Entry
• https://sourceware.org/bugzilla/show_bug.cgi?id=34442 issue-trackingExploitThird Party Advisory
• https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c… exploitExploitMitigationThird Party Advisory
• https://www.gnu.org/ broken-linkproductProduct