Skip to main content

GNU Bison CVE-2026-56390

| EUVDEUVD-2026-50277 MEDIUM
External Control of File Name or Path (CWE-73)
2026-07-29 CERT-PL GHSA-3pcj-vqw8-47jm
Information Disclosure Bison Gnu
4.6
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local vector because grammar must be processed on-machine; PR:N since crafting a malicious grammar requires no system privileges; UI:R because a user or pipeline must actively invoke Bison; integrity-only impact as the primitive is file overwrite with no confidentiality or availability consequence.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Red Hat
5.6 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 29, 2026 - 10:56 vuln.today

DescriptionCVE.org

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process.

Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

AnalysisAI

GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.

Technical ContextAI

GNU Bison is a general-purpose parser generator that transforms context-free grammars into C or C++ parsers. The vulnerability maps to CWE-73 (External Control of File Name or Path): the grammar language exposes %output and %header directives that specify where generated source and header files are written on disk. These directives are interpreted without path sanitization or restriction, and they override output paths provided by the invoking process through command-line options. Because Bison is commonly invoked during software build phases - often automatically - any grammar file sourced from an untrusted location becomes a vector for directing output to arbitrary writable paths. The affected CPE is cpe:2.3:a:gnu:bison:*:*:*:*:*:*:*:*, reflecting that the maintainer did not bound the vulnerable version range; only 3.8.2 was explicitly confirmed. Note: the 'Information Disclosure' tag on this CVE appears to be a miscategorization - the described primitive is an arbitrary local file write, not information disclosure.

RemediationAI

Apply the upstream fix commit 8d101c19d4d9aaedf83a448c925513742d4efcf0 from the Bison Savannah repository (https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=8d101c19d4d9aaedf83a448c925513742d4efcf0). This is a source-level patch; a patched release version has not been confirmed - organizations should build from the patched commit or await a formal release. As an immediate compensating control, restrict Bison invocation to grammar files sourced exclusively from trusted, internally controlled repositories, and implement mandatory code review for any grammar changes before they enter build pipelines. For CI/CD environments, run Bison inside a sandboxed container or chroot with a minimal, read-only filesystem and a narrowly scoped writable output directory - this constrains any path traversal to the container boundary. Avoid running Bison as a privileged user, as the impact radius scales directly with the process's filesystem write permissions. See the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-56389 for additional context.

More in Bison

View all
CVE-2026-56389 MEDIUM
6.8 Jul 29

Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `
CVE-2020-24240 MEDIUM
5.5 Aug 25

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is
CVE-2020-14150 MEDIUM
5.5 Jun 15

GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). Rated medium severity (CVSS 5.

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2025-0111 HIGH
7.1
CVE-2024-8517 CRITICAL POC
9.8
CVE-2024-55372 CRITICAL POC
9.8
CVE-2026-18048 HIGH POC
7.5
CVE-2024-55371 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

Share

CVE-2026-56390 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy