Description

A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length/augmentation_data_size/write_offset results in buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-14T17:17:57.163Z",
  "pubdate": "2026-09-14T17:17:57.163Z",
  "executiveSummary": "A buffer overflow vulnerability has been identified in the GNU Binutils 2.47 Eh Frame Section Handler, specifically within the _bfd_elf_write_section_eh_frame function.\nThis vulnerability stems from improper bounds checking when handling internal size parameters such as cie_length, fde_length, augmentation_data_size, and write_offset.\nThe flaw allows a local attacker to trigger a memory corruption event during the processing of crafted ELF files.\nThe impact includes potential arbitrary code execution or application crashes, posing a significant risk to the integrity of build processes and binary analysis tools that rely on the affected library.\nSuccessful exploitation requires local access to the system to submit a malformed input file to the vulnerable utility.\nAs of this report, the project maintainers have not issued a response or a patch, leaving systems running GNU Binutils 2.47 exposed to exploitation via malicious local file injection.",
  "technicalDetails": "The vulnerability resides in bfd/elf-eh-frame.c, specifically within the _bfd_elf_write_section_eh_frame function responsible for serializing Call Frame Information (CFI) into ELF binaries.\nThe root cause is a failure to perform adequate input validation on specific field lengths (cie_length, fde_length, augmentation_data_size) and the calculated write_offset during the frame parsing and construction phase.\nDuring the execution flow, the function iterates through Eh Frame entries to write them to the destination section buffer. When an attacker provides a crafted ELF input containing intentionally manipulated metadata fields, the function performs arithmetic operations on these lengths to determine the amount of data to copy into a fixed-size internal memory buffer.\nIf the attacker sets these length or offset parameters to values that exceed the pre-allocated memory boundaries, the resulting write operation proceeds past the destination buffer's capacity.\nThe exploitation process involves the following sequence: 1) The attacker constructs a malicious ELF object file where the Eh Frame headers contain inconsistent or inflated size values. 2) The attacker passes this object to a Binutils utility (e.g., objcopy or ld) that invokes _bfd_elf_write_section_eh_frame. 3) The function logic processes the malicious metadata and erroneously calculates a target pointer that points outside the allocated buffer space. 4) The subsequent memory copy or write operation triggers a heap-based buffer overflow.\nThis overflow allows for the overwriting of adjacent memory blocks, potentially redirecting control flow if sensitive data or function pointers are located nearby in memory. The vulnerability is characterized by the manipulation of these specific size indicators, which are trusted implicitly by the function during the write process.\nGiven that this vulnerability occurs during the processing of object files, it represents a threat to any software engineering environment where untrusted or externally sourced ELF files are analyzed or processed by Binutils utilities.\nBecause there are no mandatory authentication or privilege requirements to execute these tools, any local user with the ability to invoke the vulnerable Binutils components can trigger the overflow, leading to a local denial-of-service or potential local privilege escalation via controlled code execution."
}