Is CVE-2026-91779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91779 being exploited in the wild.

How severe is CVE-2026-91779?

Low severity, with a CVSS score of 3.3, published 15 September 2026.

Which products and versions are affected?

Gnu Binutils 2.47 and related development snapshots (commit 640a79623 and later).

Is there a fix for CVE-2026-91779?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91779 attacked?

It is attacked with local access.

Am I affected by CVE-2026-91779?

Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91779: GNU Binutils null pointer dereference in eh_frame section offset

CVE-2026-91779 · Severity: low · CVSS 3.3 · Published 2026-09-15

GNU Binutils is a critical toolchain component used by developers to link and process compiled object files. A malformed object file can crash the linker (ld) during a relocatable link operation, causing build failures and service interruptions. Build systems and CI pipelines that process untrusted object files are vulnerable to denial-of-service attacks.

Technologies: Gnu Binutils. Vendors: Gnu.

Quick answers

Is CVE-2026-91779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91779 being exploited in the wild.
How severe is CVE-2026-91779?: Low severity, with a CVSS score of 3.3, published 15 September 2026.
Which products and versions are affected?: Gnu Binutils 2.47 and related development snapshots (commit 640a79623 and later).
Is there a fix for CVE-2026-91779?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91779 attacked?: It is attacked with local access.
Am I affected by CVE-2026-91779?: Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A null pointer dereference vulnerability exists in the _bfd_elf_eh_frame_section_offset() function in bfd/elf-eh-frame.c. During a relocatable link (ld -r), the final link stage queries section offsets for .eh_frame relocations; when the input .eh_frame section is malformed, the CIE/FDE parsing state becomes inconsistent, and a null pointer (cie_inf) is dereferenced at offset 0xa, crashing the linker. The attack requires the ability to provide a crafted object file to the linker—typically a local attack surface, but exploitable remotely in scenarios where build systems process untrusted input. The vulnerability affects GNU Binutils 2.47 and related development snapshots; no upstream fix was available as of the report date (2026-08-16).

Affected products

GNU Binutils 2.47 and related development snapshots (commit 640a79623 and later)

Timeline

2026-07-28: disclosed: Vulnerability reported to upstream GNU Binutils project
2026-09-15: advisory: CVE-2026-91779 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.