CVE-2026-56390

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in GNU Bison

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: CERT.PL

Description

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-56390

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	bison	From 3.8.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

GNU Bison improperly handles grammar-defined output paths. Grammar directives like %output and %header allow specifying file paths without restriction, overriding caller-supplied options. Attackers can use this to write files to arbitrary writable locations, potentially overwriting existing files accessible to the Bison process.

Detection Guidance

To detect this vulnerability, inspect Bison grammar files for directives like %output or %header that specify arbitrary file paths. Check for unexpected file writes in writable directories during Bison processing. Version 3.8.2 is confirmed vulnerable; test if your version matches or update to a patched release.

Impact Analysis

This vulnerability allows an attacker to overwrite files on your system if you process a malicious grammar file with Bison. It could lead to data corruption, denial of service, or execution of arbitrary code depending on the overwritten files.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized file overwrites on the filesystem. If exploited, it may lead to unauthorized data access, modification, or destruction, which are key concerns under these regulations. However, specific compliance impacts depend on the system's use case and data processed.

Mitigation Strategies

Update GNU Bison to the latest version where the vulnerability has been fixed. Avoid using untrusted grammar files with %output or %header directives. Restrict write permissions for users running Bison.

Hi! I’m here to help you understand CVE-2026-56390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70