CVE-2026-90802
published 2026-09-14CVE-2026-90802: A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes…
PriorityP419medium4.4CVSS 3.1
AVLACLPRLUINSUCNILAL
EPSS
0.18%
7.5th percentile
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | binutils | — | — |
| gnu | binutils | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.03.2LOWAV:L/AC:L/Au:S/C:N/I:P/A:P
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A weakness has been identified in GNU Binutils 2.47.
ghsa_unreviewed·2026-09-14
CVE-2026-90802 [LOW] CWE-404 A weakness has been identified in GNU Binutils 2.47.
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
VulDB
GNU Binutils 2.47 ld bfd/libbfd.c bfd_putl64 null pointer dereference (Bug 34443)
vuldb·2026-09-13
CVE-2026-90802 [LOW] GNU Binutils 2.47 ld bfd/libbfd.c bfd_putl64 null pointer dereference (Bug 34443)
A vulnerability was found in GNU Binutils 2.47. It has been classified as problematic. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference.
This vulnerability appears as CVE-2026-90802. The attack requires local access. In addition, an exploit is available.
The project was informed of the problem early through a bug report but has not responded yet.
Red Hat
binutils: GNU Binutils: Denial of service via null pointer dereference in ld component
vendor_redhat·2026-09-14·CVSS 4.4
CVE-2026-90802 [MEDIUM] CWE-476 binutils: GNU Binutils: Denial of service via null pointer dereference in ld component
binutils: GNU Binutils: Denial of service via null pointer dereference in ld component
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
A flaw was found in GNU Binutils. A local attacker can exploit a null pointer dereference vulnerability in the `bfd_putl64` function of the `ld` component. This can lead to a denial of service or application instability.
Package: binutils (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
https://github.com/r1ck9-2q/cve_summit/blob/main/SEGV%20in%20%60bfd_putl64%60%20(bfdlibbfd.c989)%20during%20relocation%20output%20via%20malformed%20ELF.mdhttps://sourceware.org/bugzilla/show_bug.cgi?id=34443https://vuldb.com/cve/CVE-2026-90802https://vuldb.com/submit/920277https://vuldb.com/vuln/403304https://vuldb.com/vuln/403304/ctihttps://www.gnu.org/
2026-09-14
Published