CVE-2026-90802

GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability resides in the bfd_putl64 function within GNU Binutils’ linker component. A crafted input can trigger a null pointer dereference during relocation processing, leading to a crash of the ld binary. The impact is primarily a local disruption of the build process, potentially causing denial of service for developers or CI systems that rely on the linker. No elevated privileges are directly gained through this rather than remote code execution.

Affected Systems

This flaw affects the GNU Binutils 2.47 release. No other affected versions are listed in the provided data.

Risk and Exploitability

The CVSS score of 4.8 indicates a medium severity, with an EPSS score not available and absence from the CISA KEV catalog. The attack requires local access and the exploit is publicly available. Because the flaw leads only to a crash, the availability impact is moderate and the likelihood of exploitation is limited to trusted or compromised local users. The lack of a remote reachability vector reduces overall risk compared to higher‑severity vulnerabilities.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Confirm that the installed Binutils version is not 2.47; if a patched or newer version is available from the vendor, install it as early as possible.
  • If an update is not available, restrict execution of the ld linker to trusted inputs only, and consider running it inside a sandbox or isolated environment to contain a potential crash.
  • Continuously monitor the vendor’s bug tracker, advisories, and CVE feeds for an official patch; apply the fix immediately when released.

Generated by OpenCVE AI on September 15, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:gnu:binutils:2.47:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
Title GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference
First Time appeared Gnu
Gnu binutils
Weaknesses CWE-404
CWE-476
CPEs cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu binutils
References
Metrics cvssV2_0

{'score': 3.2, 'vector': 'AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.4, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-476

    NULL Pointer Dereference

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 16, 2026, 3:17 PM
Reserved
Sep 13, 2026, 3:33 PM

View source JSON

Updated
Sep 16, 2026, 3:17 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 5:17 PM
Modified
Sep 18, 2026, 2:42 PM

View source JSON

Severity
Moderate
Public date
Sep 14, 2026, 4:30 PM

View source Bugzilla JSON

Updated
Sep 15, 2026, 1:30 PM

JSON