Skip to main content

GNU Binutils EUVDEUVD-2026-78212

| CVE-2026-90829 LOW
Improper Resource Shutdown or Release (CWE-404)
2026-09-14 cna@vuldb.com GHSA-chxw-w34g-8w5c
Denial Of Service Binutils Gnu
1.9
CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local tool crash with no confidentiality or integrity impact; low-privilege local user can trigger with crafted input file.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 08:04 vuln.today
CVE Published
Sep 14, 2026 - 23:18 cve.org
LOW 1.9

DescriptionCVE.org

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

AnalysisAI

Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in bfd_elf_set_group_contents within bfd/elf.c. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local access with at least low-privilege user rights (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is minimal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch has been identified at time of analysis - the upstream Binutils project has not yet responded to the bug report filed at https://sourceware.org/bugzilla/show_bug.cgi?id=34451. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Binutils

View all
CVE-2014-8503 HIGH POC
7.5 Dec 09

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
CVE-2017-7614 CRITICAL POC
9.8 Apr 09

elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
CVE-2018-12699 CRITICAL POC
9.8 Jun 23

finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
CVE-2014-8502 HIGH POC
7.5 Dec 09

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
CVE-2017-6969 CRITICAL POC
9.1 Mar 17

readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
CVE-2014-8501 HIGH POC
7.5 Dec 09

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
CVE-2014-8504 HIGH POC
7.5 Dec 09

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
CVE-2017-9749 HIGH POC
7.8 Jun 19

The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
CVE-2017-9746 HIGH POC
7.8 Jun 19

The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
CVE-2014-8485 HIGH POC
7.5 Dec 09

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
CVE-2017-9750 HIGH POC
7.8 Jun 19

opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
CVE-2017-9748 HIGH POC
7.8 Jun 19

The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU

Same weakness CWE-404 – Improper Resource Shutdown or Release

View all
CVE-2018-8120 HIGH POC
7.0
CVE-2025-15687 LOW POC
2.1
CVE-2025-15686 LOW POC
2.1
CVE-2024-0546 HIGH POC
7.5
CVE-2024-31611 CRITICAL POC
9.1
CVE-2025-1103 HIGH POC
7.1
CVE-2022-4066 HIGH POC
8.2
CVE-2025-5867 HIGH POC
8.0

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-78212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy