CVE-2026-91781: GNU Binutils Use-After-Free Vulnerability

CVE-2026-91781 Overview

CVE-2026-91781 is a null pointer dereference vulnerability in GNU Binutils 2.47. The flaw resides in the elf_x86_64_common_section_index function within bfd/elf64-x86-64.c, part of the ELF Section Handler component. An attacker with local access can trigger the dereference by supplying a crafted ELF file, causing the affected Binutils tool to crash. The vulnerability is categorized under [CWE-404] (Improper Resource Shutdown or Release) and requires local access with low privileges. The exploit has been disclosed publicly. Upstream has addressed the issue in Binutils 2.48 via commit 7322e9bc30cb282575a701c307851fd3d66fee68.

Critical Impact
Local attackers can crash Binutils utilities such as ld, objdump, or readelf by feeding a malformed ELF64 x86-64 object, resulting in denial of service for build pipelines and analysis workflows.

Affected Products

GNU Binutils 2.47
Downstream toolchains bundling the affected bfd library
Build environments and CI systems linking against vulnerable Binutils versions

Discovery Timeline

2026-09-15 - CVE-2026-91781 published to NVD
2026-09-16 - Last updated in NVD database
Patch commit - 7322e9bc30cb282575a701c307851fd3d66fee68 merged upstream, shipped in Binutils 2.48

Technical Details for CVE-2026-91781

Vulnerability Analysis

The defect exists in elf_x86_64_common_section_index, a helper in the Binary File Descriptor (BFD) library that resolves the section index for common symbols in ELF64 x86-64 objects. When the function processes a symbol whose backing section pointer is absent or invalid, it dereferences the resulting null pointer without validation. Binutils front-end tools such as ld, objdump, nm, and readelf link against libbfd, so any of them can crash when parsing a crafted ELF object. The impact is limited to availability of the affected process. See the Sourceware Bug Report for reproduction details.

Root Cause

The root cause is missing null-pointer validation before section dereference in bfd/elf64-x86-64.c. The section handler assumes the underlying section reference for common symbols is always populated. A malformed input violates that assumption, and the unchecked dereference terminates the process.

Attack Vector

Exploitation requires local access and low privileges. An attacker supplies a crafted ELF64 x86-64 file to a target that runs a Binutils utility against it. Typical scenarios include shared build servers, package rebuild environments, malware analysis workstations, and CI runners that ingest untrusted object files. There is no network exploitation path and no impact on confidentiality or integrity.

No verified proof-of-concept code is reproduced here. Technical reproduction artifacts are available in the GitHub PoC Repository and the upstream Sourceware Git Commit.

Detection Methods for CVE-2026-91781

Indicators of Compromise

Unexpected crashes or segmentation faults in ld, objdump, nm, or readelf processes during build or analysis workflows.
Core dumps referencing elf_x86_64_common_section_index or bfd/elf64-x86-64.c in the stack trace.
Presence of untrusted ELF64 object files staged in build directories or shared upload locations.

Detection Strategies

Inventory installed Binutils versions across build servers and developer endpoints, flagging any instance at version 2.47 or earlier.
Monitor process telemetry for abnormal termination of Binutils binaries correlated with ingestion of external object files.
Alert on repeated crash signals from CI runners that process user-supplied artifacts.

Monitoring Recommendations

Enable core dump collection on build infrastructure and forward crash metadata to a centralized log store for triage.
Track file-write events that deliver .o, .a, or ELF binaries into paths consumed by Binutils tooling.
Correlate segfaults with the invoking command line to identify malformed input files.

How to Mitigate CVE-2026-91781

Immediate Actions Required

Upgrade GNU Binutils to version 2.48 or later on all systems where the toolchain is installed.
Rebuild and redeploy downstream packages that statically link against the vulnerable libbfd.
Restrict execution of Binutils utilities against untrusted ELF inputs until patching is complete.

Patch Information

The fix is available upstream as commit 7322e9bc30cb282575a701c307851fd3d66fee68 and ships in GNU Binutils 2.48. Refer to the Sourceware Git Commit for the code change and to the VulDB CVE-2026-91781 entry for coordinated advisory details.

Workarounds

Run Binutils tools inside sandboxed or containerized environments so that crashes do not disrupt shared infrastructure.
Validate the provenance of ELF object files before invoking Binutils utilities against them.
Apply least-privilege controls to accounts permitted to submit build artifacts to shared CI systems.

bash

# Verify the installed Binutils version and upgrade path
ld --version | head -n 1

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade binutils

# RHEL/Fedora
sudo dnf upgrade binutils

# Confirm the patched version (2.48 or later)
ld --version | head -n 1