EUVD-2026-78325
GHSA-9ww6-c2m6-3277
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed ELF .eh_frame object
-
DeliveryDeliver file to local victim toolchain
-
ExploitBFD parses eh_frame section
-
ExecutionNULL pointer dereference in _bfd_elf_eh_frame_section_offset
-
ImpactBinutils tool crashes (local DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local processing of an attacker-supplied malformed ELF file by a Binutils/BFD-based tool (objdump, readelf, ld, nm, etc.) so that the .eh_frame ('Eh Frame Handler') parsing path in _bfd_elf_eh_frame_section_offset is reached. Limiting factors: the attack is local only (no network vector), requires a victim to actually run a BFD tool against the crafted object, and yields only a crash of that process - no confidentiality or integrity impact and no privilege escalation. There is no vendor patch available, but real-world risk is bounded by the DoS-only outcome and the need for local file delivery. |
| Impact | This is a low-priority, high-noise item where the signals are consistent rather than conflicting. The vendor CVSS 4.0 base score is 1.9 (VC:N/VI:N/VA:L) and CWE-476 (NULL pointer dereference) confirms the impact ceiling is a crash of the local BFD-consuming tool, not code execution. The CVSS 4.0 vector is explicitly local (AV:L) and the description independently agrees ('The attack must be initiated from a local position'), so there is no attack-vector conflict. EPSS is 0.11% (2nd percentile), among the lowest possible, and there is no CISA KEV listing, so despite public exploit code the probability of widespread exploitation is negligible. SSVC reinforces this: Exploitation=poc (not active), Automatable=no, Technical Impact=partial. The one nuance is that a PoC exists (GitHub Ech06/CVE_submit and Sourceware bug 34446), which raises reproducibility but not real-world risk because the payoff is only a self-inflicted tool crash. Net: a genuine but trivial DoS-class bug - real, reproducible, and correctly rated low; not a patching priority. |
| Exploit ScenarioDerived | An attacker crafts a malformed ELF object with a corrupt .eh_frame section and induces a victim to process it locally with a Binutils/BFD tool such as objdump, readelf, or ld (e.g. inspecting an untrusted binary or building against a hostile object). _bfd_elf_eh_frame_section_offset dereferences a NULL pointer, crashing the tool. Public PoC/reproduction exists (Sourceware bugzilla 34446 and a GitHub write-up), but impact is limited to terminating the local process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Denial of service in GNU Binutils 2.47: running a BFD-based utility such as objdump, readelf, nm, or ld against a crafted ELF object drives execution into the .eh_frame ('Eh Frame Handler') parsing path, where _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c dereferences a NULL pointer and crashes the process. The vector is local only - a victim must be induced to process an attacker-supplied malformed binary - and the outcome is limited to availability loss of that single tool invocation, with no confidentiality or integrity impact, which is why the supplied CVSS v4.0 base is only 1.9 and EPSS sits at 0.11% (2nd percentile). Publicly available exploit code exists (referenced from the VulDB entry and a public GitHub proof-of-concept write-up), but there is no evidence of active exploitation and the issue is not in CISA KEV; CISA's SSVC framework classifies it as poc / not automatable / partial technical impact, and no vendor-released patch has appeared because the upstream bug report (sourceware bug 34446) has not yet been answered.
RemediationAI
No vendor-released patch identified at time of analysis: the flaw was reported upstream through the bug tracker (https://sourceware.org/bugzilla/show_bug.cgi?id=34446) but the project has not responded, so there is no fixed Binutils version to cite and no vendor advisory URL for a patch - remediation is currently mitigation-only, and teams should monitor the sourceware bug and the VulDB entry (https://vuldb.com/vuln/404050) for a corrected release or distribution backport. Because exploitation requires a local BFD tool to parse an untrusted ELF file, the highest-value control is to stop feeding untrusted binaries to Binutils utilities: block or manually triage .o/.so/executable artifacts arriving from external sources, and remove automated pipelines (fuzz harnesses, CI triage jobs, malware-scanning scripts) that invoke objdump, readelf, nm, objcopy, or ld on attacker-submitted files, accepting the workflow slowdown this causes. Where untrusted parsing cannot be avoided, run the tool inside a tight sandbox - an unprivileged user, a container with a read-only root and no network, seccomp/cgroup memory limits - so the NULL dereference terminates only a disposable process; the trade-off is added orchestration complexity and the need to keep the sandbox image current. As a temporary substitute for parsing unknown objects, LLVM's llvm-objdump/llvm-readobj can be used since they do not share the vulnerable BFD code path, at the cost of minor output-format differences from the GNU tools. Disabling core dumps on build hosts (ulimit -c 0) limits disk-fill side effects from repeated crashes, and the vulnerability is confined to the local host, so no network-level filtering or perimeter rule is applicable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU Binutils ships BFD (Binary File Descriptor), the library that reads and writes object file formats for tools including objdump, readelf, nm, objcopy, strip, and the GNU linker (ld), and which is also embedded in other consumers such as gdb. When a tool parses an ELF file, BFD walks the section table, and the .eh_frame section - the DWARF-based record of call-frame information used for C++ exception unwinding and backtracing - is handled by bfd/elf-eh-frame.c. The function _bfd_elf_eh_frame_section_offset resolves and returns the file offset of a section referenced by a frame entry; when the crafted input manipulates the associated section/entry state so that an expected pointer is never populated, the routine follows a NULL pointer, the classic CWE-476 root-cause class, and the hosting process faults. Only GNU Binutils 2.47 is confirmed affected by the EUVD record, but the supplied CPE string cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:* is an unversioned wildcard, so downstream distributions and any vendored copy of libbfd must be mapped to the fixed revision individually. Authentication framing differs between sources: the input CVSS v4.0 vector specifies PR:L/UI:N (local privileges assumed), while our independent assessment models it as PR:N/UI:R, requiring the victim to be socially engineered into opening the malformed object; either way the attack surface is a local file consumed by a developer or build tool.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local file parsing crash: AV:L and UI:R since a victim must run a BFD tool on the crafted file; no privileges needed (PR:N); only a self-process DoS, so C:N/I:N/A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the component Eh Frame Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Exploit-DB