EUVD-2026-78215
GHSA-4xpf-8h39-fxrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege access
-
DeliveryCraft malicious ELF object file
-
ExploitInvoke Binutils tool (ld/objcopy) with crafted input
-
ExecutionTrigger null pointer dereference in _bfd_write_merged_section
-
ImpactTool crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires local system access with at least low privilege (PR:L per CVSS 4.0) and the ability to supply a crafted input file to a Binutils tool that exercises the Section Merge code path in |
| Impact | The overall risk is very low, consistent with the CVSS 4.0 base score of 1.9. The local attack vector (AV:L) and low-privilege requirement (PR:L) severely restrict exploitation scope to users who can supply crafted input files to Binutils tools on the same system - even a mid-sized municipal IT team in zabrze running automated build pipelines would face minimal external exposure since the attack surface is limited to developer workstations and CI build agents, not public-facing services. No KEV listing exists, and while E:P confirms a public POC, the impact is confined to crashing a developer tool (DoS only in practice, despite the CVSS 4.0 VC:L/VI:L/VA:L impact ratings, which appear overstated for a simple null pointer dereference crash). EPSS data is not provided, but given the local-only, developer-tool nature of the flaw, real-world exploitation probability is negligible outside of adversarial build-chain scenarios. |
| Exploit ScenarioDerived | A local attacker with access to a shared build server supplies a specially crafted ELF object file as input to a Binutils linking operation (e.g., via |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable _bfd_write_merged_section function in bfd/merge.c. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
RemediationAI
No vendor-released patch is available at the time of analysis; the GNU Binutils project has not responded to the responsible disclosure report filed via https://sourceware.org/bugzilla/show_bug.cgi?id=34452. As a compensating control, restrict access to Binutils toolchain binaries to trusted users and avoid processing untrusted or externally-sourced object files and archives through linker or merge operations. In CI/CD environments, run build jobs in isolated containers or sandboxes (e.g., with seccomp or user namespaces) so a crash does not affect adjacent workloads. Organizations may also monitor for unofficial patches or backports from downstream distributors (Fedora, Debian, Gentoo) who often apply fixes ahead of upstream releases. Check the bugzilla ticket for upstream status before acting.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU Binutils is a suite of binary-format utilities (linker ld, assembler as, objcopy, nm, etc.) built on the BFD library, which abstracts binary file formats including ELF, COFF, and PE. The vulnerable function _bfd_write_merged_section in bfd/merge.c is invoked during the section-merging phase of linking, where identical or mergeable ELF sections (e.g., .rodata.str) are consolidated. CWE-404 is assigned, which describes improper resource shutdown or release, but the described behavior - null pointer dereference - more precisely maps to CWE-476; the mismatch suggests a classification error by the reporting CNA. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with E:P confirms local exploitability with a public proof of concept. Affected version is Binutils 2.47 per EUVD-2026-78215.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Local-only null pointer dereference crash in a developer tool; no confidentiality or integrity impact, availability impact is low (tool crash only).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Exploit-DB