Description

A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 addresses this issue. The name of the patch is 471130b39c03623ec6d78ece377ff4da3f6bfe7b. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T17:17:56.983Z",
  "pubdate": "2026-09-14T17:17:56.983Z",
  "executiveSummary": "A critical buffer overflow vulnerability has been identified within the GNU Binutils ld linker component, specifically affecting the elf_x86_64_relocate_section function in bfd/elf64-x86-64.c.\nThe vulnerability arises from improper handling of the 'roff' argument during the relocation process, which can lead to memory corruption.\nThe flaw affects GNU Binutils version 2.47 and requires local access for successful exploitation.\nSuccessful exploitation allows an attacker to trigger a buffer overflow, potentially leading to arbitrary code execution or a denial-of-service state within the linker process.\nGiven that proof-of-concept exploit code has been disclosed publicly, the risk is elevated, necessitating immediate patching of the affected environment.\nOrganizations relying on the ld linker should prioritize upgrading to version 2.48 to eliminate the vulnerability.",
  "technicalDetails": "The vulnerability resides within the bfd/elf64-x86-64.c source file, specifically in the logic governing section relocation, defined in the elf_x86_64_relocate_section function. This function is responsible for calculating relocation addresses for x86-64 ELF binaries during the linking process.\nThe root cause of this vulnerability is an unchecked or improperly validated manipulation of the 'roff' argument. In the context of binary relocation, 'roff' typically represents a relocation offset. If this offset is maliciously crafted by an attacker within a specially prepared object file, it can lead to an out-of-bounds write operation.\nWhen the ld linker processes a malformed input object, the 'roff' value is used to calculate memory addresses for relocation data. If the offset calculation does not account for the boundaries of the destination buffer, the application writes data beyond the allocated buffer limits. This results in a heap or stack-based buffer overflow, depending on how the affected memory region is allocated at runtime.\nThe attack flow requires the attacker to provide a malicious ELF object file to the vulnerable ld instance. Since the vulnerability is triggered during the linking phase, the attacker must have local access to execute the linker against the crafted file. Upon processing, the linker attempts to apply relocations; the flaw causes it to read or write memory outside the intended scope.\nExploitation of this overflow can facilitate the corruption of critical data structures, such as function pointers or return addresses. By precisely controlling the overflow payload, an attacker can redirect the execution flow of the linker process to arbitrary instructions, effectively achieving code execution within the security context of the user running the toolchain. Alternatively, the vulnerability can be leveraged to cause an unhandled segmentation fault, resulting in a denial-of-service condition.\nThe vulnerability is limited to the x86-64 target architecture implementation within Binutils 2.47. There are no network exposure requirements for this attack, as it is inherently a local exploit vector targeting build-time processes. Authentication requirements are consistent with standard local system access, and no special elevated privileges are strictly required beyond the ability to execute the linker with malicious input."
}