CVE-2026-91782: GNU Binutils Use-After-Free Vulnerability

CVE-2026-91782 Overview

CVE-2026-91782 is a null pointer dereference vulnerability in GNU Binutils version 2.47. The flaw resides in the elf_x86_allocate_dynrelocs function within bfd/elfxx-x86.c, part of the Dynamic Relocation Allocation component. An attacker with local access and low privileges can trigger the dereference, causing the affected binutils process to crash. The issue is categorized under [CWE-404: Improper Resource Shutdown or Release]. Public proof-of-concept material is available, but the vulnerability does not enable code execution or information disclosure. Upgrading to GNU Binutils 2.48 resolves the issue.

Critical Impact
Local attackers can trigger a null pointer dereference in elf_x86_allocate_dynrelocs, producing a denial-of-service condition in tools that link against the affected bfd library.

Affected Products

GNU Binutils 2.47
Components linking bfd/elfxx-x86.c from the affected release
Downstream toolchains bundling GNU Binutils 2.47

Discovery Timeline

2026-09-15 - CVE-2026-91782 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91782

Vulnerability Analysis

The vulnerability resides in the elf_x86_allocate_dynrelocs function in bfd/elfxx-x86.c. This function participates in dynamic relocation allocation for x86 ELF objects processed by the Binary File Descriptor (bfd) library. When binutils tools such as ld, objdump, or objcopy process a crafted ELF input, the function dereferences a pointer that has not been validated as non-null. The result is a process crash rather than memory corruption or code execution. Impact is confined to availability of the affected tool. See the Sourceware Bug Report for the upstream discussion.

Root Cause

The underlying defect is missing input validation prior to pointer dereference inside the dynamic relocation allocation path. The affected code assumes a required data structure is present for every relocation entry, but crafted ELF metadata can leave the pointer unset. The [CWE-404] classification reflects improper handling of a resource state that the function relies upon.

Attack Vector

Exploitation requires local access and low-privileged execution of a binutils tool against attacker-supplied input. There is no network vector and no user interaction requirement beyond invoking the vulnerable tool on the malicious object file. The outcome is a denial-of-service condition against the running binutils process; confidentiality and integrity are not affected.

No verified exploit code is reproduced here. Technical details and reproducer artifacts are available in the GitHub PoC Repository and the VulDB CVE-2026-91782 entry.

Detection Methods for CVE-2026-91782

Indicators of Compromise

Unexpected crashes of ld, objdump, objcopy, readelf, or other binutils tools when parsing untrusted ELF inputs.
Core dumps referencing elf_x86_allocate_dynrelocs in bfd/elfxx-x86.c on the crashing stack frame.
Build pipeline failures that correlate with ingestion of externally supplied object files or static libraries.

Detection Strategies

Inventory hosts running GNU Binutils and flag any system reporting version 2.47.
Monitor CI/CD workers and developer endpoints for repeated segmentation faults in binutils processes.
Compare package versions against the fixed 2.48 release across Linux distributions and container base images.

Monitoring Recommendations

Ingest process crash telemetry (for example, systemd-coredump events) into a centralized log platform for correlation.
Alert on binutils invocations that consume ELF files sourced from untrusted directories such as upload staging or shared build caches.
Track distribution security advisories referencing the upstream commits d1268210b6f6, 471130b39c0, 283d3198bed, 0a84e560216, and a692a633d40.

How to Mitigate CVE-2026-91782

Immediate Actions Required

Upgrade GNU Binutils to version 2.48 or later on all affected hosts, build agents, and container images.
Restrict access to build systems so that only trusted users can supply object files to binutils tooling.
Rebuild and redeploy downstream projects that statically link the bfd library from the vulnerable release.

Patch Information

The issue is addressed in GNU Binutils 2.48. The upstream fix is identified by commits d1268210b6f6, 471130b39c0, 283d3198bed, 0a84e560216, and a692a633d40. Refer to the Sourceware Bug Report for patch context and to distribution advisories for backported packages.

Workarounds

Avoid running vulnerable binutils tools against ELF files from untrusted sources until the upgrade is applied.
Execute binutils operations inside sandboxed or ephemeral build environments that can absorb a crash without wider impact.
Enforce least-privilege execution so that a crashed binutils process cannot disrupt shared build infrastructure.

bash

# Verify installed binutils version and upgrade on Debian/Ubuntu
ld --version | head -n 1
sudo apt-get update && sudo apt-get install --only-upgrade binutils

# Verify installed binutils version and upgrade on RHEL/Fedora
rpm -q binutils
sudo dnf upgrade binutils