Executive brief
GNU Binutils is a collection of low-level tools used by developers and build systems to process compiled code. A vulnerability in the ELF string table handling function can cause the linker (ld) to crash when processing specially crafted object files with versioning information, potentially disrupting build pipelines and creating a denial-of-service condition during compilation.
Technical details
The vulnerability is a memory corruption issue in the _bfd_elf_strtab_delref function in bfd/elf-strtab.c within GNU Binutils 2.47. It is triggered when the linker processes a malformed ELF object file with versioned symbols and the --version-exports-section flag enabled. The attack vector is local and requires the attacker to provide a malicious object file to be linked with specific command-line options. The vulnerability causes a BFD_ASSERT failure manifesting as a segmentation fault, disrupting the linking process. As of the advisory date, the project had not yet issued a patch, though a proof-of-concept has been publicly disclosed.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-07-28: disclosed: Bug report filed with proof-of-concept
- 2026-09-14: advisory: CVE-2026-90831 published on NVD