EUVD-2026-78212
GHSA-chxw-w34g-8w5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed ELF with bad SHT_GROUP
-
ExploitSubmit to binutils-invoking process
-
Executionbfd_elf_set_group_contents reads null ptr
-
ImpactProcess crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires local access with at least low-privilege user rights (PR:L per CVSS 4.0). The attacker must be able to supply a crafted ELF binary as input to a binutils tool (objdump, nm, ld, or similar) that invokes the BFD ELF backend. The tool must process the malformed SHT_GROUP section, triggering the null pointer dereference. This limits exploitation to: local or CI/CD users who can run binutils, scenarios where untrusted ELF files are ingested (e.g., open-source contribution pipelines, binary analysis workflows, automated package builds). There is no network-facing attack path - AV:L precludes remote exploitation. No special OS configuration, feature flag, or privileged account is required beyond basic user-level execution of a binutils binary. |
| Impact | Real-world risk is minimal. The CVSS 4.0 score of 1.9 and local attack vector (AV:L/PR:L) confine exploitation to users who can already run binutils tools - developers, CI/CD build agents, or package-build environments. The vulnerability causes a null pointer dereference, meaning the impact is a process crash (denial of service against the specific tool invocation), not code execution or data exfiltration; the input CVSS 4.0 assigns VC:L/VI:L/VA:L, but for a null dereference crash those C/I components are likely overstated - availability impact (VA:L) is the realistic outcome. The E:P (exploit proof-of-concept) modifier in the CVSS 4.0 supplemental vector confirms a public PoC exists (linked via Bugzilla attachment 16883), elevating urgency marginally for environments where untrusted ELF files are processed. However, it is not in CISA KEV and EPSS data is not provided in the input. The vendor has not yet patched or responded; no fix version is available. For most organizations, this is a watch-and-patch item rather than an emergency. |
| Exploit ScenarioDerived | A developer or automated CI system runs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in bfd_elf_set_group_contents within bfd/elf.c. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
RemediationAI
No vendor-released patch has been identified at time of analysis - the upstream Binutils project has not yet responded to the bug report filed at https://sourceware.org/bugzilla/show_bug.cgi?id=34451. Monitor that tracker for a fix. As an interim compensating control, restrict which users can invoke binutils tools on untrusted ELF input by applying filesystem-level access controls or sandboxing (e.g., running binutils in a restricted container or with seccomp filters) to limit exposure to the crash. In automated binary analysis pipelines, validate ELF magic bytes and basic header sanity before passing files to binutils tools, which will reduce - though not eliminate - the attack surface. Upgrading to a patched release once available is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU Binutils is a collection of binary utilities (objdump, nm, ld, as, readelf, etc.) that process ELF-format object files and executables on Linux and other Unix-like systems. The affected component is the BFD (Binary File Descriptor) library's ELF backend, specifically the bfd_elf_set_group_contents function in bfd/elf.c, which handles SHT_GROUP sections - a feature of the ELF format that groups related sections together for linker visibility control. When a malformed ELF input omits or zeroes out required group-section pointers, the function dereferences a null pointer rather than validating input first. The assigned CWE is CWE-404 (Improper Resource Shutdown or Release), but the described behavior is a classic null pointer dereference, more precisely classified as CWE-476. The affected version confirmed by EUVD is Binutils 2.47.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Local tool crash with no confidentiality or integrity impact; low-privilege local user can trigger with crafted input file.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Exploit-DB