# Gnu Binutils vulnerabilities

Source: https://junglewise.ai/threats/technologies/binutils  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/binutils.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 42 vulnerabilities in Gnu Binutils: 0 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91782, was published on 15 September 2026. Nothing in the last four weeks, down from 12 vulnerabilities in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 12
- All time: 42 (0 critical, 0 exploited in the wild)

## About Gnu Binutils

Collection of binary tools for assembling, linking, and manipulating object files and executables.

## Latest Gnu Binutils vulnerabilities

- [CVE-2026-91782: GNU Binutils null pointer dereference in dynamic relocation allocation](https://junglewise.ai/threats/cve-2026-91782-gnu-binutils-null-pointer-dereference-in-dynamic-relocation) (low, CVSS 3.3, published 15 Sep 2026)
- [CVE-2026-91781: GNU Binutils null pointer dereference in ELF section handler](https://junglewise.ai/threats/cve-2026-91781-gnu-binutils-null-pointer-dereference-in-elf-section-handler) (low, CVSS 3.3, published 15 Sep 2026)
- [CVE-2026-91780: GNU Binutils null pointer dereference in ELF linker](https://junglewise.ai/threats/cve-2026-91780-gnu-binutils-null-pointer-dereference-in-elf-linker) (low, CVSS 3.3, published 15 Sep 2026)
- [CVE-2026-91779: GNU Binutils null pointer dereference in eh_frame section offset](https://junglewise.ai/threats/cve-2026-91779-gnu-binutils-null-pointer-dereference-in-eh-frame-section-offset) (low, CVSS 3.3, published 15 Sep 2026)
- [CVE-2026-90831: GNU Binutils memory corruption in ELF string table handling](https://junglewise.ai/threats/cve-2026-90831-gnu-binutils-memory-corruption-in-elf-string-table-handling) (medium, CVSS 5.3, published 14 Sep 2026)
- [CVE-2026-90830: GNU Binutils null pointer dereference in section merge](https://junglewise.ai/threats/cve-2026-90830-gnu-binutils-null-pointer-dereference-in-section-merge) (medium, CVSS 5.3, published 14 Sep 2026)
- [CVE-2026-90829: GNU Binutils null pointer dereference in SHT_GROUP handler](https://junglewise.ai/threats/cve-2026-90829-gnu-binutils-null-pointer-dereference-in-sht-group-handler) (medium, CVSS 5.3, published 14 Sep 2026)
- [CVE-2026-90828: GNU Binutils null pointer dereference in ELF orphan section handler](https://junglewise.ai/threats/cve-2026-90828-gnu-binutils-null-pointer-dereference-in-elf-orphan-section) (medium, CVSS 5.3, published 14 Sep 2026)
- [CVE-2026-90804: GNU Binutils heap buffer overflow in eh_frame handler](https://junglewise.ai/threats/cve-2026-90804-gnu-binutils-heap-buffer-overflow-in-eh-frame-handler) (medium, CVSS 4.8, published 14 Sep 2026)
- [CVE-2026-90803: GNU Binutils buffer overflow in elf_x86_64_relocate_section](https://junglewise.ai/threats/cve-2026-90803-gnu-binutils-buffer-overflow-in-elf-x86-64-relocate-section) (medium, CVSS 5.3, published 14 Sep 2026)
- [CVE-2026-90802: GNU Binutils ld null pointer dereference in bfd_putl64](https://junglewise.ai/threats/cve-2026-90802-gnu-binutils-ld-null-pointer-dereference-in-bfd-putl64) (medium, CVSS 4.4, published 14 Sep 2026)
- [CVE-2026-90801: GNU Binutils ld heap buffer overflow in cache_bwrite](https://junglewise.ai/threats/cve-2026-90801-gnu-binutils-ld-heap-buffer-overflow-in-cache-bwrite) (medium, CVSS 5.3, published 14 Sep 2026)
- [CVE-2026-19548: GNU binutils ld use-after-free in add_archive_element](https://junglewise.ai/threats/cve-2026-19548-gnu-binutils-ld-use-after-free-in-add-archive-element) (medium, CVSS 5.5, published 12 Aug 2026)
- [CVE-2026-18220: GNU binutils out-of-bounds write in BFD DLX ELF backend](https://junglewise.ai/threats/cve-2026-18220-gnu-binutils-out-of-bounds-write-in-bfd-dlx-elf-backend) (high, CVSS 7.8, published 29 Jul 2026)
- [CVE-2026-15003: GNU Binutils heap overflow in linker XCOFF processing](https://junglewise.ai/threats/cve-2026-15003-gnu-binutils-heap-overflow-in-linker-xcoff-processing) (medium, CVSS 5.6, published 27 Jul 2026)
- [CVE-2026-6846: GNU binutils heap buffer overflow in xcoff_link_add_symbols](https://junglewise.ai/threats/cve-2026-6846-gnu-binutils-heap-buffer-overflow-in-xcoff-link-add-symbols) (high, CVSS 7.8, published 22 Apr 2026)
- [CVE-2026-6845: GNU binutils Denial of Service in readelf](https://junglewise.ai/threats/cve-2026-6845-gnu-binutils-denial-of-service-in-readelf) (medium, CVSS 5, published 22 Apr 2026)
- [CVE-2026-6844: GNU binutils Denial of Service in readelf](https://junglewise.ai/threats/cve-2026-6844-gnu-binutils-denial-of-service-in-readelf) (medium, CVSS 5.5, published 22 Apr 2026)
- [CVE-2026-4647: GNU Binutils BFD library out-of-bounds read in XCOFF relocation processing](https://junglewise.ai/threats/cve-2026-4647-gnu-binutils-bfd-library-out-of-bounds-read-in-xcoff-relocation) (medium, CVSS 6.1, published 23 Mar 2026)
- [CVE-2026-3442: GNU Binutils out-of-bounds read in bfd linker](https://junglewise.ai/threats/cve-2026-3442-gnu-binutils-out-of-bounds-read-in-bfd-linker) (medium, CVSS 6.1, published 16 Mar 2026)
- [CVE-2026-3441: GNU Binutils out-of-bounds read in BFD linker](https://junglewise.ai/threats/cve-2026-3441-gnu-binutils-out-of-bounds-read-in-bfd-linker) (medium, CVSS 6.1, published 16 Mar 2026)
- [CVE-2025-66866: An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a…](https://junglewise.ai/threats/cve-2025-66866-an-issue-was-discovered-in-function-d-abi-tags-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66865: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to…](https://junglewise.ai/threats/cve-2025-66865-an-issue-was-discovered-in-function-d-print-comp-inner-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66864: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to…](https://junglewise.ai/threats/cve-2025-66864-an-issue-was-discovered-in-function-d-print-comp-inner-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66863: An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a…](https://junglewise.ai/threats/cve-2025-66863-an-issue-was-discovered-in-function-d-discriminator-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)

## Most severe Gnu Binutils vulnerabilities

- [CVE-2026-6846: GNU binutils heap buffer overflow in xcoff_link_add_symbols](https://junglewise.ai/threats/cve-2026-6846-gnu-binutils-heap-buffer-overflow-in-xcoff-link-add-symbols) (high, CVSS 7.8, published 22 Apr 2026)
- [CVE-2026-18220: GNU binutils out-of-bounds write in BFD DLX ELF backend](https://junglewise.ai/threats/cve-2026-18220-gnu-binutils-out-of-bounds-write-in-bfd-dlx-elf-backend) (high, CVSS 7.8, published 29 Jul 2026)
- [CVE-2025-66865: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to…](https://junglewise.ai/threats/cve-2025-66865-an-issue-was-discovered-in-function-d-print-comp-inner-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66863: An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a…](https://junglewise.ai/threats/cve-2025-66863-an-issue-was-discovered-in-function-d-discriminator-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66862: A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause…](https://junglewise.ai/threats/cve-2025-66862-a-buffer-overflow-vulnerability-in-function-gnu-special-in-file) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66866: An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a…](https://junglewise.ai/threats/cve-2025-66866-an-issue-was-discovered-in-function-d-abi-tags-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2025-66864: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to…](https://junglewise.ai/threats/cve-2025-66864-an-issue-was-discovered-in-function-d-print-comp-inner-in-file-cp) (high, CVSS 7.5, published 29 Dec 2025)
- [CVE-2026-3442: GNU Binutils out-of-bounds read in bfd linker](https://junglewise.ai/threats/cve-2026-3442-gnu-binutils-out-of-bounds-read-in-bfd-linker) (medium, CVSS 6.1, published 16 Mar 2026)
- [CVE-2026-3441: GNU Binutils out-of-bounds read in BFD linker](https://junglewise.ai/threats/cve-2026-3441-gnu-binutils-out-of-bounds-read-in-bfd-linker) (medium, CVSS 6.1, published 16 Mar 2026)
- [CVE-2026-4647: GNU Binutils BFD library out-of-bounds read in XCOFF relocation processing](https://junglewise.ai/threats/cve-2026-4647-gnu-binutils-bfd-library-out-of-bounds-read-in-xcoff-relocation) (medium, CVSS 6.1, published 23 Mar 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 12 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 12 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Gnu technologies

- [GnuTLS](https://junglewise.ai/threats/technologies/gnutls): 21 vulnerabilities
- [Gnu Glibc](https://junglewise.ai/threats/technologies/glibc): 20 vulnerabilities
- [Gnu LibreDWG](https://junglewise.ai/threats/technologies/libredwg): 14 vulnerabilities
- [Gnu Emacs](https://junglewise.ai/threats/technologies/emacs): 10 vulnerabilities
- [GNU tar](https://junglewise.ai/threats/technologies/tar): 10 vulnerabilities
- [Gnu C Library](https://junglewise.ai/threats/technologies/c-library): 9 vulnerabilities
- [Gnu Bash](https://junglewise.ai/threats/technologies/bash): 7 vulnerabilities
- [Gnu Wget](https://junglewise.ai/threats/technologies/wget): 7 vulnerabilities
- [Gnu Cpio](https://junglewise.ai/threats/technologies/cpio): 5 vulnerabilities
- [Gnu Grub2](https://junglewise.ai/threats/technologies/grub2): 5 vulnerabilities
- [Gnu Aspell](https://junglewise.ai/threats/technologies/aspell): 4 vulnerabilities
- [GNU Coreutils](https://junglewise.ai/threats/technologies/coreutils): 4 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Gnu Binutils vulnerabilities", https://junglewise.ai/threats/technologies/binutils, 13 November 2026.