CVE-2026-91781
Received Received - Intake

Null Pointer Dereference in GNU Binutils

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 is able to address this issue. The identifier of the patch is 7322e9bc30cb282575a701c307851fd3d66fee68. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91781
EUVD
EUVD-2026-78329

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnu binutils to 2.48 (exc)
gnu binutils to 2.48 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a null pointer dereference in GNU Binutils 2.47 affecting the elf_x86_64_common_section_index function in the ELF Section Handler component. It occurs in the file bfd/elf64-x86-64.c and can be exploited locally. The issue has been publicly disclosed and a patch exists in version 2.48.

Detection Guidance

Since this is a null pointer dereference vulnerability in GNU Binutils affecting elf_x86_64_common_section_index, detection requires checking the version of Binutils installed. Run 'binutils --version' or 'ld -v' to verify if the version is below 2.48. If it is, the system is vulnerable.

Impact Analysis

The vulnerability may cause a denial of service by crashing the application due to a null pointer dereference. Since it requires local access, attackers must already have some level of access to the system. Upgrading to Binutils 2.48 mitigates this risk.

Mitigation Strategies

Upgrade GNU Binutils to version 2.48 or later immediately. This can typically be done via package managers like 'apt', 'yum', or 'dnf' depending on your distribution. For example, run 'sudo apt update && sudo apt upgrade binutils' on Debian-based systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91781. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart