Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-90802: GNU Binutils ld may crash on crafted input

CVE-2026-90802 · published 1 month ago

Summary

The ld tool in GNU Binutils version 2.47 can crash if it receives specially crafted data, due to a coding mistake that tries to use a missing pointer. This problem can only be triggered by someone with access to the same computer, but it could be used to disrupt processes that rely on the tool. Update to a newer Binutils release or apply any patches provided by your Linux distribution to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	gnu	binutils	2.47
Debian:12	debian	binutils	All versions
Ubuntu:Pro:14.04:LTS	canonical	binutils	All versions

Original advisory text

GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34443 Third Party Advisory
https://www.gnu.org/ URL
https://vuldb.com/cve/CVE-2026-90802 Vendor Advisory
https://vuldb.com/submit/920277 Vendor Advisory
https://ubuntu.com/security/CVE-2026-90802 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-90802 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-90802 Vendor Advisory
https://vuldb.com/vuln/403304 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90802... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-90802 Vendor Advisory
https://github.com/r1ck9-2q/cve_summit/blob/main/SEGV%20in%20%60bfd_putl64%60%20... Exploit
https://vuldb.com/vuln/403304/cti Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.6 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

CWE-404Improper Resource Shutdown or Release

Timeline

Published14 Sep 2026

Updated3 Nov 2026

First seen14 Sep 2026

Sources

CVE-2026-90802 · NVD

CVE-2026-90802 · MITRE

DEBIAN-CVE-2026-90802 · OSV

UBUNTU-CVE-2026-90802 · OSV

CVE-2026-90802 · OSV

Track software like this

Free during beta