CVE-2026-90804: Buffer Overflow in GNU Binutils
A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length/augmentation_data_size/write_offset results in buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
AI Analysis
Technical Summary
This vulnerability in GNU Binutils 2.47 involves a buffer overflow in the _bfd_elf_write_section_eh_frame function within the file bfd/elf-eh-frame.c. The issue is triggered by manipulating the arguments cie_length, fde_length, augmentation_data_size, or write_offset, causing a buffer overflow condition. Exploitation requires local access and user interaction. The vulnerability is publicly known, but no official vendor response or patch has been provided as of the publication date.
Potential Impact
Successful exploitation could lead to a buffer overflow condition on a local system, potentially allowing an attacker with local access and user interaction to cause memory corruption. The CVSS score of 2.4 indicates a low severity impact, suggesting limited potential for significant system compromise or remote exploitation.
Mitigation Recommendations
No official patch or vendor advisory is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict local access to trusted users only and avoid running untrusted code that could trigger this vulnerability.
CVE-2026-90804: Buffer Overflow in GNU Binutils
Description
A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length/augmentation_data_size/write_offset results in buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
CVSS v4.0
Score 2.4low
Affected software
GNU
Binutils
cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in GNU Binutils 2.47 involves a buffer overflow in the _bfd_elf_write_section_eh_frame function within the file bfd/elf-eh-frame.c. The issue is triggered by manipulating the arguments cie_length, fde_length, augmentation_data_size, or write_offset, causing a buffer overflow condition. Exploitation requires local access and user interaction. The vulnerability is publicly known, but no official vendor response or patch has been provided as of the publication date.
Potential Impact
Successful exploitation could lead to a buffer overflow condition on a local system, potentially allowing an attacker with local access and user interaction to cause memory corruption. The CVSS score of 2.4 indicates a low severity impact, suggesting limited potential for significant system compromise or remote exploitation.
Mitigation Recommendations
No official patch or vendor advisory is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict local access to trusted users only and avoid running untrusted code that could trigger this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-13T15:33:49.112Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa8289355bf5e2cf557f786
Added to database: 09/14/2026, 17:02:11 UTC
Last enriched: 09/14/2026, 17:16:51 UTC
Last updated: 09/15/2026, 04:15:19 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.