CVE-2026-91779: GNU Binutils Use-After-Free Vulnerability

CVE-2026-91779 Overview

CVE-2026-91779 is a null pointer dereference vulnerability in GNU Binutils 2.47. The flaw resides in the _bfd_elf_eh_frame_section_offset function within bfd/elf-eh-frame.c, part of the Eh Frame Handler component. An attacker with local access and low privileges can trigger the dereference by supplying a crafted ELF input, causing the affected process to crash. The issue is classified under [CWE-404] (Improper Resource Shutdown or Release) and impacts availability only. Public exploit details have been released, and the upstream project has not yet responded to the initial bug report.

Critical Impact
Local attackers can crash tools that link against libbfd (such as ld, objdump, or readelf) by supplying a malformed ELF object, producing a denial-of-service condition.

Affected Products

GNU Binutils 2.47
Downstream toolchains bundling libbfd 2.47
Build pipelines invoking ld, objdump, objcopy, or readelf on untrusted objects

Discovery Timeline

2026-09-15 - CVE-2026-91779 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91779

Vulnerability Analysis

The vulnerability lives in _bfd_elf_eh_frame_section_offset, a helper inside the Binary File Descriptor (BFD) library used by GNU Binutils to parse ELF .eh_frame sections. When the function processes a crafted ELF object, it dereferences a pointer that was never validated for a null value. The resulting segmentation fault terminates the running Binutils tool. Because libbfd is embedded in ld, objdump, readelf, gdb, and various downstream binary-analysis utilities, any workflow that ingests untrusted ELF files can be affected.

Root Cause

The root cause is missing validation of a pointer returned during Exception Handling (EH) frame processing. The function assumes a related section or CIE/FDE structure is present before dereferencing it. When the expected structure is absent or malformed, the dereference operates on a null pointer. [CWE-404] captures the improper handling of resources that leads to this unsafe access pattern.

Attack Vector

Exploitation requires local access and low privileges. An attacker supplies a crafted ELF file to a target that invokes a libbfd-based tool, for example a build server, a CI job that runs objdump on artifacts, or a sandbox that inspects uploaded binaries. Successful triggering crashes the tool but does not yield code execution, information disclosure, or integrity impact. Public technical details are available through the Sourceware Bugzilla Report #34446 and the GitHub Bug Report for CVE-2026-91779.

No verified proof-of-concept code is published in a form suitable for reproduction here. Refer to the linked Bugzilla entry for reproduction steps and the malformed ELF construction pattern.

Detection Methods for CVE-2026-91779

Indicators of Compromise

Repeated segmentation faults or SIGSEGV core dumps from ld, objdump, readelf, or other libbfd consumers.
Build or CI job failures correlated with ingestion of untrusted or externally supplied ELF objects.
Kernel log entries such as binutils[pid]: segfault at 0 originating from _bfd_elf_eh_frame_section_offset.

Detection Strategies

Enable core dumps on build hosts and inspect stack traces for frames pointing to _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c.
Instrument CI pipelines to record exit codes of Binutils invocations and alert on non-zero terminations tied to signal 11.
Fuzz local Binutils installations with malformed ELF corpora to confirm whether the deployed version is vulnerable.

Monitoring Recommendations

Monitor process termination events for ld, ld.bfd, objdump, objcopy, readelf, and addr2line on build infrastructure.
Track the provenance of ELF inputs consumed by shared build systems and flag objects arriving from untrusted contributors.
Correlate crash telemetry with the installed Binutils package version to prioritize hosts running 2.47.

How to Mitigate CVE-2026-91779

Immediate Actions Required

Inventory hosts running GNU Binutils 2.47 and identify any exposure to untrusted ELF inputs.
Restrict execution of libbfd-based utilities on untrusted binaries in shared build and analysis systems.
Subscribe to the Sourceware Bugzilla Report #34446 to track upstream response and patch availability.

Patch Information

No vendor patch is available at the time of publication. The upstream GNU Binutils project has been notified through Bugzilla but has not yet responded. Track fixes through the GNU Project Homepage and the VulDB CVE-2026-91779 Entry. Downgrade to an earlier stable Binutils release only after validating that it does not reintroduce other known issues in the environment.

Workarounds

Run Binutils tools that process untrusted ELF files inside sandboxes or containers with resource limits and automatic restart.
Gate CI pipelines with pre-validation that rejects malformed ELF headers before invoking libbfd-based utilities.
Limit local shell access on build servers so that only trusted identities can stage arbitrary ELF payloads.

bash

# Configuration example: check installed Binutils version and
# isolate untrusted ELF analysis inside a restricted namespace
ld --version | head -n 1

systemd-run --user --scope \
  -p MemoryMax=256M -p TasksMax=64 -p NoNewPrivileges=yes \
  objdump -h /path/to/untrusted.o