Quick answers
- Is CVE-2026-91782 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-91782 being exploited in the wild.
- How severe is CVE-2026-91782?
- Low severity, with a CVSS score of 3.3, published 15 September 2026.
- Which products and versions are affected?
- Gnu Binutils 2.47.
- Is there a fix for CVE-2026-91782?
- A patch was published on 2026-07-30: First patch committed (d1268210b6f6) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-91782 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-91782?
- Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a null pointer dereference in the elf_x86_allocate_dynrelocs function within bfd/elfxx-x86.c, triggered when processing malformed dynamic relocation information in ELF object files. The root cause stems from the dynamic relocation allocation path failing to properly validate or initialize section-related variables (htab, sreloc) when handling excluded or malformed sections. Attack requires local file access; an attacker can craft a malicious ELF object file that triggers the crash when processed by the linker. The flaw affects only local build environments with the ability to provide crafted input files. Patches have been committed to the master branch (commits d1268210b6f6, 471130b39c0, and others), and upgrading to version 2.48 or later resolves the issue.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-07-28: disclosed: Vulnerability reported to Sourceware Bugzilla as bug 34448
- 2026-07-30: patched: First patch committed (d1268210b6f6)
- 2026-09-15: advisory: CVE-2026-91782 published