CVE-2026-90830
MediumCVSS 5.3Summary
A security vulnerability has been detected in GNU Binutils 2.47 in the function _bfd_write_merged_section of file bfd/merge.c, related to Section Merge. The manipulation leads to a null pointer dereference. The attack requires local access and the exploit has been publicly disclosed.
Risk Assessment
A local attacker can use the publicly available exploit to trigger a null pointer dereference, potentially causing crashes and disruption in binary processing. The lack of project response means a fix may not be available.
Recommendation
Avoid processing untrusted binaries with Binutils and monitor official releases to apply a fix. Until then, consider isolating tools that use Binutils.
Other vulnerabilities in GNU Binutils
See all- CVE-2026-91782Low
A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_allocate_dynrelocs in bfd/elfxx-x86.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.
- CVE-2026-91781Low
A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_64_common_section_index in bfd/elf64-x86-64.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.
- CVE-2026-91780Low
A vulnerability was detected in GNU Binutils 2.47 in the function elf_link_add_object_symbols in bfd/elflink.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.
- CVE-2026-91779Low
A vulnerability was detected in GNU Binutils 2.47 in the function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.
- CVE-2026-90831Medium
A vulnerability was detected in GNU Binutils 2.47 in the function _bfd_elf_strtab_delref of file bfd/elf-strtab.c, related to the ELF String Table. The manipulation results in memory corruption. The attack requires local access and the exploit is publicly available.
- CVE-2026-90829Medium
A weakness has been identified in GNU Binutils 2.47 in the function bfd_elf_set_group_contents of file bfd/elf.c, related to the SHT_GROUP Section Handler. The manipulation can lead to a null pointer dereference. The attack requires local access and the exploit is publicly available.
- CVE-2026-90828Medium
A security flaw has been discovered in GNU Binutils 2.47 in the function elf_orphan_compatible of file ld/ldelf.c, related to the ELF Orphan Section Handler. The manipulation results in a null pointer dereference. The attack requires local access and the exploit has been publicly released.
- CVE-2026-90804Medium
In GNU Binutils 2.47, a vulnerability was detected in the function _bfd_elf_write_section_eh_frame in the file bfd/elf-eh-frame.c, in the Eh Frame Section Handler component. Manipulation of the arguments cie_length/fde_length/augmentation_data_size/write_offset leads to a buffer overflow. The attack requires local access.
- CVE-2026-90803Medium
In GNU Binutils 2.47, a vulnerability was detected in the function elf_x86_64_relocate_section in the file bfd/elf64-x86-64.c, in the ld component. Manipulation of the argument roff leads to a buffer overflow. The attack requires local access. A fix is available in version 2.48.
- CVE-2026-90802Medium
In GNU Binutils 2.47, a weakness was identified in the function bfd_putl64 in the file bfd/libbfd.c, in the ld component. This manipulation causes a null pointer dereference. The attack requires local access.
Original NVD description (English source)
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.