EUVD-2026-78329
GHSA-x33g-4rqc-v4wq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted ELF64 object
-
DeliveryUser runs Binutils utility on it
-
ExploitBFD parses section table
-
Executionelf_x86_64_common_section_index dereferences NULL
-
ImpactUtility crashes (local DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | All signals point to a low-severity, availability-only issue. The CVSS 4.0 base scores 1.9 with AV:L (local), AC:L, PR:L, UI:N, and only VA:L - no confidentiality or integrity impact - which is consistent with the CWE-476 classification. Exploitation requires local interaction with the toolchain (e.g., running a Binutils utility against a malicious ELF), and the public PoC (bugzilla 34449) demonstrates a crash rather than code execution. This is NOT in CISA KEV, and the exploit-disclosed flag reflects public PoC availability, not in-the-wild weaponization. Given the local vector, trivial impact, and denial-of-service-only outcome, this is a hardening/maintenance fix rather than a priority patching emergency; the main concern is build-pipeline or CI availability if attackers can plant crafted binaries that developers process. Note the reported CVSS score and severity label are self-consistent, and no conflicting signals are present. |
| Exploit ScenarioDerived | An attacker crafts a malicious ELF64 x86-64 object containing a section layout that yields a NULL pointer in elf_x86_64_common_section_index(), then convinces a victim (or a CI/build system) to process it with a Binutils utility such as readelf or objdump. The utility dereferences the NULL pointer and crashes, aborting the process. Public PoC code exists (bugzilla 34449 via https://github.com/Ech06/CVE_submit/tree/main/bugzilla/pocs/34449), making reproduction straightforward, but impact is limited to a local denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
RemediationAI
Upgrade GNU Binutils to version 2.48, which resolves this issue; the corresponding upstream fix is commit 7322e9bc30cb282575a701c307851fd3d66fee68 (https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7322e9bc30cb282575a701c307851fd3d66fee68). Apply the distribution's updated binutils package rather than building from source where possible to preserve system integrity. If immediate upgrade is not feasible, treat Binutils as an untrusted-input processor: avoid running readelf/objdump/objcopy against ELF files from untrusted sources on production systems, and perform such inspection in an isolated container or sandbox - the trade-off is reduced convenience and the requirement for a disposable environment. No network-facing workaround exists because the trigger is a locally supplied file; restricting who can introduce binaries into CI/build pipelines (code review, artifact signing, controlled artifact repositories) limits the realistic attack surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNU Binutils is the core collection of binary utilities (ld, objdump, readelf, objcopy, etc.) built on libbfd, the Binary File Descriptor library. The affected routine elf_x86_64_common_section_index() lives in bfd/elf64-x86-64.c and resolves the section index during ELF64 x86-64 section handling. Root cause is CWE-476 (NULL Pointer Dereference): the function dereferences a pointer that can be NULL when processing a malformed or adversarial ELF object, causing the utility to abort. This is a robustness/parsing defect in BFD's section-interpretation logic rather than a memory-corruption flaw. CPE cpe:2.3:a:gnu:binutils confirms the affected product line, and EUVD lists Binutils 2.47 as the impacted version.
Know when Binutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Triggered locally by processing a crafted ELF with the tool, so AV:L and PR:L; only availability is affected, no confidentiality or integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 is able to address this issue. The identifier of the patch is 7322e9bc30cb282575a701c307851fd3d66fee68. It is suggested to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attac
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member a
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) o
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remo
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. Rate
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attac
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (b
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a deni
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers t
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
Exploit-DB