CVE-2026-90828

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in GNU Binutils ELF Handler

Publication date: 2026-09-14

Last updated on: 2026-09-21

Assigner: VulDB

Description

A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-90828

EUVD

EUVD-2026-78171

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	binutils	2.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a null pointer dereference vulnerability in GNU Binutils 2.47 affecting the ELF Orphan Section Handler function elf_orphan_compatible in ld/ldelf.c. It requires local access to trigger and has been publicly disclosed with an exploit available.

Detection Guidance

Detection requires checking for the affected GNU Binutils version 2.47 and verifying the presence of the vulnerable elf_orphan_compatible function in ld/ldelf.c. No specific commands are provided in the context to detect this vulnerability directly.

Impact Analysis

The vulnerability could allow a local attacker to cause a denial of service or potentially execute arbitrary code on systems using affected Binutils versions. Since it requires local access, remote exploitation is not possible.

Compliance Impact

This vulnerability, a null pointer dereference in GNU Binutils 2.47, has limited direct impact on compliance with standards like GDPR or HIPAA. It requires local access and has low exploitability, which reduces the risk of unauthorized data exposure or system compromise. However, if exploited, it could potentially lead to denial-of-service conditions, indirectly affecting availability requirements in regulated environments.

Mitigation Strategies

Update GNU Binutils to a patched version if available. Monitor for unusual activity in ld/ldelf.c or ELF orphan section handling. Restrict local access to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-90828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70