A local‑execution weakness has been identified in GNU Binutils 2.47. The function elf_link_add_object_symbols in bfd/elflink.c dereferences a null pointer when processing specially crafted object files, causing the linker to crash. This fault is classified as a null pointer dereference (CWE‑476) and results in a local denial of service for any process that uses the vulnerable linker.

Affected systems are those running GNU Binutils 2.47. No other versions or vendors have been reported to contain the flaw, and the issue is confined to the Binutils package. It manifests when users invoke the linker on maliciously constructed inputs.

The CVSS score of 4.8 indicates moderate impact, while the EPSS score of less than 1% signals a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the exploit requires local execution, the risk is limited to environments where an attacker already has some level of local access. A publicly available proof‑of‑concept demonstrates the crash, indicating that the weakness is exploitable without additional assistance.