Executive brief
GNU Binutils is a critical toolchain component used by developers to link and process compiled object files. A malformed object file can crash the linker (ld) during a relocatable link operation, causing build failures and service interruptions. Build systems and CI pipelines that process untrusted object files are vulnerable to denial-of-service attacks.
Technical details
A null pointer dereference vulnerability exists in the _bfd_elf_eh_frame_section_offset() function in bfd/elf-eh-frame.c. During a relocatable link (ld -r), the final link stage queries section offsets for .eh_frame relocations; when the input .eh_frame section is malformed, the CIE/FDE parsing state becomes inconsistent, and a null pointer (cie_inf) is dereferenced at offset 0xa, crashing the linker. The attack requires the ability to provide a crafted object file to the linker—typically a local attack surface, but exploitable remotely in scenarios where build systems process untrusted input. The vulnerability affects GNU Binutils 2.47 and related development snapshots; no upstream fix was available as of the report date (2026-08-16).
Affected products
- GNU Binutils 2.47 and related development snapshots (commit 640a79623 and later)
Timeline
- 2026-07-28: disclosed: Vulnerability reported to upstream GNU Binutils project
- 2026-09-15: advisory: CVE-2026-91779 published