CVE-2026-90830
published 2026-09-14CVE-2026-90830: A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component…
PriorityP427medium5.3CVSS 3.1
AVLACLPRLUINSUCLILAL
EPSS
0.17%
5.4th percentile
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | binutils | — | — |
| gnu | binutils | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.04.3MEDIUMAV:L/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A security vulnerability has been detected in GNU Binutils 2.47.
ghsa_unreviewed·2026-09-15
CVE-2026-90830 [LOW] CWE-404 A security vulnerability has been detected in GNU Binutils 2.47.
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
VulDB
GNU Binutils 2.47 Section Merge bfd/merge.c _bfd_write_merged_section null pointer dereference (Bug 34452)
vuldb·2026-09-13
CVE-2026-90830 [LOW] GNU Binutils 2.47 Section Merge bfd/merge.c _bfd_write_merged_section null pointer dereference (Bug 34452)
A vulnerability was found in GNU Binutils 2.47. It has been classified as problematic. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference.
This vulnerability is documented as CVE-2026-90830. The attack needs to be performed locally. Additionally, an exploit exists.
The project was informed of the problem early through a bug report but has not responded yet.
Red Hat
binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge
vendor_redhat·2026-09-14·CVSS 5.3
CVE-2026-90830 [MEDIUM] CWE-476 binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge
binutils: GNU Binutils: Local denial of service via null pointer dereference in Section Merge
A flaw was found in GNU Binutils. This vulnerability, located in the _bfd_write_merged_section function within the Section Merge component, allows a local attacker to trigger a null pointer dereference. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.
Package: binutils (Red Hat Enterprise Linux 10) - Under investigation
Package: gcc-toolset-15-binutils (Red Hat Enterprise Linux 10) - Under investigation
Package: gcc-toolset-16-binutils (Red Hat Enterprise Linux 10) - Under investigation
Package: gdb (Red Hat Enterprise Linux 10) - Under investigation
Package: mingw-binutils (Red Hat Enterprise Linux 10) - Under investigation
Packag
No detection rules found.
No public exploits indexed.
2026-09-14
Published