GNU Binutils EUVD-2026-78171

Exploitation requires local system access and the ability to invoke the GNU ld linker with a crafted ELF object file as input. Any unprivileged user who can run ld and supply input files is sufficient - no elevated privileges are required. The vulnerability is constrained to Binutils 2.47 specifically. Exploitation is limited by its local-only attack vector (no network exposure), its restriction to a developer/build tool rather than a service, and the impact ceiling of a single user-space process crash. There are no special configuration settings or enabled features required beyond having Binutils 2.47 installed and having a user who can run the linker against attacker-controlled input.

Real-world risk here is very low despite the existence of a public proof-of-concept. The CVSS 4.0 score of 1.9 accurately reflects the constrained exploitation conditions: local access with low privileges is required, and the only reliable outcome is a crash of the ld linker process - a transient, user-scoped availability impact. The VC:L/VI:L metrics in the submitted CVSS 4.0 vector appear overstated; a simple null pointer dereference in a user-space tool yields no meaningful confidentiality or integrity impact. EPSS data is not provided, but given the local, non-privileged nature of the flaw and its impact limited to a developer/build tool, exploitation probability in enterprise environments is extremely low. Even a mid-sized municipal IT team in malbork would reasonably deprioritize this in favour of network-reachable, unauthenticated vulnerabilities, unless their threat model specifically includes developer workstation integrity. The public PoC marginally elevates risk in automated build pipelines where untrusted object files are linked, but no KEV listing and no known escalation beyond DoS have been observed. No vendor patch is yet available, which is notable but less urgent given the negligible impact ceiling.

A local user with low privileges creates a crafted ELF object file containing an orphan section designed to trigger the NULL dereference in elf_orphan_compatible. Running ld against this file causes the linker to crash, disrupting any build process relying on that invocation. A public PoC demonstrating this crash has been published at https://sourceware.org/bugzilla/attachment.cgi?id=16882.