CVE-2026-90802
Received Received - Intake

Null Pointer Dereference in GNU Binutils

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90802
EUVD
EUVD-2026-77632

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnu binutils 2.47
gnu binutils to 2.48 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90802 is a segmentation fault (SEGV) vulnerability in GNU Binutils 2.47 affecting the bfd_putl64 function in bfd/libbfd.c. It occurs during ELF object linking when using specific flags like --gc-sections. A malformed relocation causes a NULL pointer write, leading to invalid memory access. The crash happens via a call chain from elf_x86_64_relocate_section through several functions before reaching bfd_putl64.

Detection Guidance

To detect this vulnerability, monitor for segmentation faults in the GNU linker (ld) when processing ELF objects with specific flags like --gc-sections --no-print-gc-sections -w. Check for crashes in bfd_putl64 during relocation output or BFD assertion failures prior to crashes.

Impact Analysis

This vulnerability can cause process crashes or denial of service when linking malformed ELF objects. In some cases, it may allow a controlled write primitive depending on heap layout, potentially leading to further exploitation. Local access is required to trigger the attack.

Compliance Impact

This vulnerability causes a segmentation fault in GNU Binutils during ELF object linking, leading to process crashes or denial of service. It does not directly impact data confidentiality or integrity but may disrupt system availability, which could affect compliance with standards requiring system reliability like HIPAA's availability requirements. GDPR compliance is less directly affected unless the crash leads to data processing interruptions.

Mitigation Strategies

Avoid using the problematic linker flags --gc-sections --no-print-gc-sections -w on untrusted object files. Audit object-file provenance in build systems and run linking steps in sandboxed environments to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart