CVE-2026-15003: Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service
CVE-2026-15003 is a vulnerability in Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service, rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.6 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.15% probability of exploitation activity in the next 30 days, higher than 4% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 2 products in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-15003
- Severity
- Medium CVSS 5.6
- Microsoft severity
- Moderate
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-125
- EPSS
- 0.15% (percentile 4%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- July 2026 Patch Tuesday
- Product families
- Open Source Software
CVSS score and vector
Microsoft scores CVE-2026-15003 at 5.6 (temporal 5.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H/E:U
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | Low |
| Integrity impact | None |
| Availability impact | High |
| Exploit code maturity | Unproven |
Affected products (2)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 gdb 13.2-10 on Azure Linux 3.0 | CBL-Mariner Releases | Security Update | 13.2-11 | No |
| azl3 gdb 13.2-11 on Azure Linux 3.0 | Security update | Security Update | 13.2-11 |
NIST NVD data
- NVD status
- Awaiting Analysis
- NVD CVSS
- 5.6 (MEDIUM)
- NVD weakness
- CWE-125
- Published to NVD
- NVD last modified
References
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | Information published. | |
| 2.0 | Information published. | |
| 3.0 | Information published. | |
| 4.0 | Information published. | |
| 5.0 | Information published. |