Executive brief
GNU Binutils is a toolset used by developers to manipulate binary files and debug compiled programs. A null pointer flaw in the ELF linker can cause the tool to crash when processing specially crafted object files, disrupting build processes and development workflows. Exploitation requires local access and user interaction to process a malicious file.
Technical details
The vulnerability is a null pointer dereference in the elf_link_add_object_symbols function within bfd/elflink.c of GNU Binutils 2.47. It is triggered by manipulated ELF object files during the linking process. The attack vector is local and requires an attacker to supply a malicious object file that is processed by the vulnerable linker. Successful exploitation leads to denial of service through application crash. Public exploit code has been disclosed, though no active exploitation in the wild has been reported. The vendor has not yet issued a patch.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-09-15: disclosed
- other: Public exploit code made available