Executive brief
GNU Binutils is a collection of binary utilities, including the ld linker used to combine object files during software compilation. A flaw in version 2.47 allows a local attacker to cause the linker to crash by providing a malformed ELF object file, resulting in service disruption during the build process and potential denial of service in automated build pipelines.
Technical details
The vulnerability is a null pointer dereference in the bfd_putl64 function (bfd/libbfd.c:989) triggered when processing a malformed ELF relocation. The attack chain originates in elf_x86_64_relocate_section, which calls bfd_elf64_swap_reloca_out, eventually reaching bfd_putl64 with an underflowed or null output buffer pointer. When the linker processes a crafted ELF object with options like --gc-sections --no-print-gc-sections -w, the malformed relocation causes a write to a null-derived address, triggering a segmentation fault. The vulnerability requires local access and the ability to provide a malicious object file to the linker. A proof-of-concept has been publicly disclosed, and the issue remains unpatched; a previous fix for a related crash at the same location (bug 33456) appears incomplete.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-07-28: disclosed: Bug reported to Sourceware Bugzilla
- 2026-08-09: exploited: Public PoC released by r1ck9
- 2026-09-14: advisory: Published as CVE-2026-90802