CVE-2026-91782
Received Received - Intake

Null Pointer Dereference in GNU Binutils

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.48 addresses this issue. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91782
EUVD
EUVD-2026-78335

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnu binutils to 2.48 (inc)
gnu binutils 2.48

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a null pointer dereference issue in GNU Binutils 2.47. It affects the function elf_x86_allocate_dynrelocs in the file bfd/elfxx-x86.c, which handles dynamic relocation allocation. A local attacker can exploit this to cause a crash or potentially execute arbitrary code.

Detection Guidance

This vulnerability is specific to GNU Binutils 2.47 and involves a null pointer dereference in the elf_x86_allocate_dynrelocs function. Detection requires checking the installed version of Binutils. Use the command 'binutils --version' to verify if version 2.47 is installed. If it is, the system is vulnerable.

Impact Analysis

The vulnerability allows a local attacker to crash the affected system or execute arbitrary code. Since it requires local access, the impact is limited to systems where the attacker has local privileges. Upgrading to version 2.48 mitigates this risk.

Mitigation Strategies

Upgrade GNU Binutils to version 2.48 or later to address the vulnerability. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Follow standard update procedures for your system to apply the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91782. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart