CVE-2026-90804 in Binutils
Summary
by MITRE • 09/14/2026
A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length/augmentation_data_size/write_offset results in buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/19/2026
The GNU Binutils suite, specifically version 2.47, contains a critical memory safety vulnerability within its ELF (Executable and Linkable Format) section handling components. This flaw resides in the _bfd_elf_write_section_eh_frame function located in the bfd/elf-eh-frame.c source file. The Eh Frame Section Handler is responsible for processing exception handling frame information, which is crucial for stack unwinding during program execution or debugging sessions. When this component processes malformed input files containing crafted ELF sections with specific characteristics related to CIE (Common Information Entry) length, FDE (Frame Data Entry) length, augmentation data size, and write offset parameters, it fails to perform adequate bounds checking before writing data to memory buffers. This lack of validation allows an attacker who controls these arguments to trigger a buffer overflow condition within the application's address space.
From a technical perspective, this vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input (Classic Buffer Overflow). The root cause lies in the arithmetic operations used to calculate destination pointers and copy lengths based on user-supplied or file-derived values such as cie_length, fde_length, augmentation_data_size, and write_offset. If these values are manipulated to exceed the allocated buffer limits, the subsequent memory write operation will overwrite adjacent memory regions. This can lead to arbitrary code execution if an attacker can control the content written beyond the buffer boundary, potentially overwriting function return addresses, exception handlers, or other critical data structures within the process memory space. The vulnerability is strictly local in nature, meaning that a user must have access to execute commands on the system and provide crafted input files to Binutils tools such as objdump, readelf, or ld for exploitation.
The operational impact of this vulnerability extends beyond simple application crashes. While denial of service through segmentation faults is an immediate consequence, the ability to achieve arbitrary code execution poses a severe security risk in development environments where developers frequently process untrusted binary files from external sources. Since Binutils are often used as part of build pipelines or static analysis workflows, compromising these tools could allow an attacker to inject malicious payloads into compiled binaries or exfiltrate sensitive information present in the memory space during processing. The fact that exploit code is publicly available significantly increases the risk landscape, enabling less sophisticated actors to leverage this flaw for targeted attacks against systems running vulnerable versions of GNU Binutils without requiring complex reverse engineering efforts.
In terms of industry alignment, this vulnerability also relates to CWE-787, which covers Out-of-bounds Write vulnerabilities, as the overflow writes data outside the intended memory boundary. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, exploitation of this flaw aligns with techniques associated with Initial Access and Execution phases, particularly when used in conjunction with social engineering to trick users into opening malicious ELF files or integrating compromised binaries into projects. The vulnerability highlights the importance of robust input validation in low-level system utilities that handle binary formats, where memory management errors can have catastrophic security implications despite being triggered locally.
Mitigation strategies should focus on immediate patching and operational controls until an official fix is released by the GNU Binutils project. Users running version 2.47 or affected versions should upgrade to a patched release as soon as it becomes available from upstream sources. In environments where upgrading is not immediately feasible, restricting access to Binutils tools to trusted users only can reduce the attack surface. Additionally, employing sandboxing techniques for processing untrusted binary files can contain potential impacts by isolating the execution environment. Security teams should also monitor for indicators of compromise related to unusual memory usage patterns or crashes in development and build systems that utilize GNU Binutils components. Continuous monitoring and adherence to secure coding practices during future updates will help prevent similar vulnerabilities from being introduced into critical infrastructure tools.