CVE-2026-90829

Received Received - Intake

Null Pointer Dereference in GNU Binutils

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-90829

EUVD

EUVD-2026-78212

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	binutils	2.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a null pointer dereference flaw in GNU Binutils 2.47, specifically in the bfd_elf_set_group_contents function of the bfd/elf.c file. It occurs in the SHT_GROUP Section Handler component. The issue can be triggered by a local manipulation, leading to a crash or unexpected behavior.

Impact Analysis

The vulnerability allows an attacker to cause a denial of service or potentially execute arbitrary code on the affected system. Since it requires local access, it may be exploited by users with limited privileges. The public availability of an exploit increases the risk of real-world attacks.

Mitigation Strategies

Update GNU Binutils to a version that addresses the null pointer dereference issue in bfd_elf_set_group_contents. Monitor vendor advisories for patches. Restrict local access to prevent exploitation until patched.

Hi! I’m here to help you understand CVE-2026-90829. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70