CVE-2026-90803: Buffer Overflow in GNU Binutils
A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 addresses this issue. The name of the patch is 471130b39c03623ec6d78ece377ff4da3f6bfe7b. It is recommended to upgrade the affected component.
AI Analysis
Technical Summary
The vulnerability CVE-2026-90803 exists in GNU Binutils 2.47 within the elf_x86_64_relocate_section function of the ld component (file bfd/elf64-x86-64.c). Improper manipulation of the 'roff' argument causes a buffer overflow condition. This flaw requires local access to exploit and does not require user interaction. The vulnerability has a CVSS 4.8 (medium) score and a public exploit is available. The issue is fixed in GNU Binutils version 2.48 with patch 471130b39c03623ec6d78ece377ff4da3f6bfe7b.
Potential Impact
Successful exploitation of this vulnerability can lead to a buffer overflow, which may allow an attacker with local access to cause a denial of service or potentially execute arbitrary code with limited privileges. The CVSS score of 4.8 indicates a medium severity impact with local attack vector and low complexity.
Mitigation Recommendations
Upgrade GNU Binutils to version 2.48 or later, which contains the official fix for this vulnerability (patch 471130b39c03623ec6d78ece377ff4da3f6bfe7b). No other mitigations are specified or required.
CVE-2026-90803: Buffer Overflow in GNU Binutils
Description
A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 addresses this issue. The name of the patch is 471130b39c03623ec6d78ece377ff4da3f6bfe7b. It is recommended to upgrade the affected component.
CVSS v4.0
Score 4.8medium
Affected software
GNU
Binutils
cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-90803 exists in GNU Binutils 2.47 within the elf_x86_64_relocate_section function of the ld component (file bfd/elf64-x86-64.c). Improper manipulation of the 'roff' argument causes a buffer overflow condition. This flaw requires local access to exploit and does not require user interaction. The vulnerability has a CVSS 4.8 (medium) score and a public exploit is available. The issue is fixed in GNU Binutils version 2.48 with patch 471130b39c03623ec6d78ece377ff4da3f6bfe7b.
Potential Impact
Successful exploitation of this vulnerability can lead to a buffer overflow, which may allow an attacker with local access to cause a denial of service or potentially execute arbitrary code with limited privileges. The CVSS score of 4.8 indicates a medium severity impact with local attack vector and low complexity.
Mitigation Recommendations
Upgrade GNU Binutils to version 2.48 or later, which contains the official fix for this vulnerability (patch 471130b39c03623ec6d78ece377ff4da3f6bfe7b). No other mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-13T15:33:45.622Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa8289355bf5e2cf557f78b
Added to database: 09/14/2026, 17:02:11 UTC
Last enriched: 09/14/2026, 17:16:40 UTC
Last updated: 09/14/2026, 17:33:52 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.