CVE-2026-91780: GNU Binutils Use-After-Free Vulnerability

CVE-2026-91780 Overview

CVE-2026-91780 is a null pointer dereference vulnerability in GNU Binutils version 2.47. The flaw resides in the elf_link_add_object_symbols function within bfd/elflink.c, a component responsible for processing ELF object symbols during linking operations. An attacker with local access can trigger the dereference by supplying a crafted input, causing the affected process to crash. A public proof-of-concept has been published, though the upstream project has not yet acknowledged the bug report. The weakness is categorized under [CWE-404: Improper Resource Shutdown or Release].

Critical Impact
Local attackers can cause denial of service in linker or object-processing workflows by triggering a null pointer dereference in elf_link_add_object_symbols, disrupting build pipelines and tooling that depend on GNU Binutils.

Affected Products

GNU Binutils 2.47
Toolchains and build systems bundling the affected bfd library
Downstream distributions shipping Binutils 2.47 (ld, objdump, readelf)

Discovery Timeline

2026-09-15 - CVE-2026-91780 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91780

Vulnerability Analysis

The vulnerability exists in elf_link_add_object_symbols, a core routine in the Binary File Descriptor (BFD) library used by GNU Binutils to process ELF object symbols during link-time operations. When the function processes a malformed or crafted ELF object, it dereferences a pointer without validating that it is non-null. This causes the linker or any BFD-consuming utility to terminate abnormally. Because Binutils tools such as ld, objdump, readelf, and nm all rely on the BFD library, any workflow that ingests untrusted object files is exposed. Exploitation requires local access and low privileges, limiting the blast radius to environments where an attacker can supply object files to a linking operation.

Root Cause

The root cause is missing input validation on a pointer used inside elf_link_add_object_symbols in bfd/elflink.c. The function proceeds to dereference a data structure returned from earlier parsing without confirming it was initialized. When a specially crafted ELF file omits or corrupts the expected section, the pointer remains null and the subsequent access triggers a segmentation fault.

Attack Vector

The attack vector is local. An attacker must be able to supply a malicious ELF object file to a Binutils tool executed on the target system. Typical exploitation scenarios include automated build agents that process untrusted source or object contributions, forensic tooling parsing attacker-supplied binaries, and shared multi-user development hosts. Successful exploitation results in a crash of the consuming process. See the Sourceware Bug Report and the GitHub PoC Repository for reproduction details.

No verified exploit code is reproduced here. Refer to the linked proof-of-concept repository for technical specifics.

Detection Methods for CVE-2026-91780

Indicators of Compromise

Unexpected crash signals (SIGSEGV) from ld, objdump, readelf, or other BFD-linked utilities during automated builds
Core dumps referencing elf_link_add_object_symbols or bfd/elflink.c in the stack trace
Presence of untrusted or newly introduced ELF object files in build inputs preceding tool crashes

Detection Strategies

Monitor build pipelines and CI/CD systems for abnormal termination of Binutils processes and correlate with recent object file additions
Enable core dump collection on build hosts and inspect faulting addresses within BFD symbol-processing routines
Track process exit codes from ld and related tools; repeated crashes on specific inputs indicate potential exploitation attempts

Monitoring Recommendations

Log invocations of Binutils tools along with the object files they process on multi-user and CI systems
Alert on repeated SIGSEGV events originating from developer or build service accounts
Inventory hosts running Binutils 2.47 and prioritize monitoring where untrusted object files may be ingested

How to Mitigate CVE-2026-91780

Immediate Actions Required

Identify systems running GNU Binutils 2.47 by querying package inventories on Linux distributions
Restrict execution of Binutils tools against untrusted or attacker-controlled ELF object files
Isolate build agents that process third-party contributions to contain crash-based disruption

Patch Information

No upstream patch has been released. The project was notified through the Sourceware Bug Report but has not responded. Track upstream commits to bfd/elflink.c and downstream distribution advisories for a fix. Additional context is available in the VulDB Vulnerability Report.

Workarounds

Avoid running Binutils 2.47 against object files sourced from untrusted parties until a fix is available
Downgrade to an earlier stable Binutils release not affected by the flaw where operationally feasible
Sandbox linker and BFD tool execution using seccomp, containers, or unprivileged user contexts to limit crash impact

bash

# Verify installed Binutils version and locate affected binaries
ld --version
rpm -q binutils   # RPM-based distributions
dpkg -s binutils  # Debian-based distributions