GNU Binutils EUVD-2026-78216

Exploitation requires local access to a system with GNU Binutils 2.47 installed and the ability to invoke a Binutils tool (such as objcopy, ld, nm, or readelf) against an attacker-controlled ELF file. Low OS-level privileges are sufficient (PR:L per CVSS). No elevated permissions, special daemon state, non-default build flags, or specific OS configuration are required - only the ability to run standard Binutils utilities. Exploitation is strictly limited to local attack vectors; remote unauthenticated exploitation is not possible. Systems that do not process attacker-supplied ELF files with Binutils 2.47 are not at risk.

The CVSS 4.0 score of 1.9 is notably low, consistent with a local, low-privilege attack yielding only partial (L/L/L) impact. No CISA KEV listing exists and no EPSS score was provided in the available data. The CVSS 4.0 E:P modifier confirms a public proof-of-concept, which marginally elevates practical risk over a purely theoretical finding - an attacker can validate exploitability without additional research investment. However, the local attack vector is a hard constraint: remote exploitation is not possible, and an attacker must already have code execution or filesystem write access. Realistic risk is confined to environments that automatically process untrusted ELF files through Binutils 2.47 tools - for example, CI/CD pipelines ingesting third-party object files, binary analysis platforms, or malware sandboxes using Binutils for disassembly. The absence of an upstream patch is the most operationally relevant concern, as there is no clean remediation path at time of analysis. Overall, this is a low-severity, developer-toolchain issue with a narrow exploitation surface and no evidence of targeted or opportunistic exploitation.

A local attacker with access to a build pipeline or binary analysis system crafts a malicious ELF object file with a pathological string table structure - leveraging the publicly available proof-of-concept - and submits it for processing by a Binutils tool such as objcopy or ld. The _bfd_elf_strtab_delref function performs an improper operation on the string table buffer, corrupting heap memory. Depending on heap layout at runtime, the outcome ranges from a process crash to limited disclosure of adjacent heap contents.