Description

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T17:17:56.610Z",
  "pubdate": "2026-09-14T17:17:56.610Z",
  "executiveSummary": "A critical buffer overflow vulnerability has been identified in the cache_bwrite function within the bfd/cache.c file of the GNU Binutils 2.47 ld component. The flaw arises from improper handling of the nbytes argument, which facilitates a memory corruption condition during write operations.\nThe vulnerability allows for a local attacker to potentially execute arbitrary code or cause a denial-of-service state through the manipulation of process memory. Given that the exploit is publicly available, the risk to affected systems is elevated. The vulnerability requires local access to the system, meaning the attacker must already have a foothold or physical access to invoke the vulnerable functionality.\nAlthough the project maintainers were notified via a bug report, no official remediation or patch has been issued. Organizations utilizing GNU Binutils 2.47 should consider immediate security hardening measures to restrict access to the ld component and monitor for unauthorized execution of binutils-related tasks.",
  "technicalDetails": "The vulnerability is situated in the bfd/cache.c source file within the GNU Binutils 2.47 suite, specifically affecting the cache_bwrite function utilized by the ld linker. The root cause is a heap or stack-based buffer overflow triggered by an insufficiently validated nbytes argument. In the context of the BFD (Binary File Descriptor) library, the cache_bwrite function is responsible for performing write operations to cached file descriptors. By providing a crafted nbytes value, an attacker can influence the buffer management logic, leading to an out-of-bounds write operation.\nThe attack flow commences when a user supplies a maliciously crafted object file or input file to the ld linker. When the linker invokes cache_bwrite to handle file buffering, the uncontrolled nbytes argument allows data to be written beyond the allocated boundaries of the internal destination buffer. Because the buffer resides in process memory, this overflow can overwrite adjacent metadata, return addresses, or function pointers.\nExploitation requires the attacker to have local access to the target environment where the vulnerable ld binary is executed. Since the exploit is publicly available, an attacker can construct a payload that leverages this buffer overflow to redirect the execution flow of the linker process. Successful exploitation results in arbitrary code execution with the privileges of the user running the linker process. If the process is invoked with elevated permissions, the impact escalates to full system compromise.\nTechnical analysis suggests that the vulnerability stems from a lack of boundary checking on the nbytes input before performing copy operations into the internal cache buffer. The BFD library's design assumes that the caller provides sanitized input; however, in the case of ld processing untrusted input files, this assumption fails. The lack of proper bounds enforcement means that the internal buffer, designed to optimize I/O, becomes a vector for memory corruption. Post-exploitation, the stability of the linker process is compromised, typically resulting in a crash (DoS), or in more sophisticated scenarios, the redirection of the instruction pointer to attacker-controlled shellcode residing in the process memory space."
}