A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
References
| Link | Resource |
|---|---|
| https://sourceware.org/bugzilla/attachment.cgi?id=16884 | Third Party Advisory Issue Tracking |
| https://sourceware.org/bugzilla/show_bug.cgi?id=34452 | Third Party Advisory Issue Tracking |
| https://vuldb.com/cve/CVE-2026-90830 | Third Party Advisory |
| https://vuldb.com/submit/925229 | Third Party Advisory |
| https://vuldb.com/vuln/403332 | Third Party Advisory |
| https://vuldb.com/vuln/403332/cti | Permissions Required |
| https://www.gnu.org/ | Product |
Configurations
History
16 Sep 2026, 15:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gnu:binutils:2.47:*:*:*:*:*:*:* | |
| References | () https://sourceware.org/bugzilla/attachment.cgi?id=16884 - Third Party Advisory, Issue Tracking | |
| References | () https://sourceware.org/bugzilla/show_bug.cgi?id=34452 - Third Party Advisory, Issue Tracking | |
| References | () https://vuldb.com/cve/CVE-2026-90830 - Third Party Advisory | |
| References | () https://vuldb.com/submit/925229 - Third Party Advisory | |
| References | () https://vuldb.com/vuln/403332 - Third Party Advisory | |
| References | () https://vuldb.com/vuln/403332/cti - Permissions Required | |
| References | () https://www.gnu.org/ - Product | |
| First Time |
Gnu
Gnu binutils |
Information
Published : 2026-09-14 23:18
Updated : 2026-09-16 15:28
NVD link : CVE-2026-90830
Mitre link : CVE-2026-90830
CVE.ORG link : CVE-2026-90830
JSON object : View
Products Affected
gnu
- binutils