Gnu Bison vulnerabilities

CVE-2026-56389 [HIGH] CWE-78 CVE-2026-56389: GNU Bison allows for an execution of an arbitrary program during HTML report generation due to impro GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When runni

CVE-2026-56390 [MEDIUM] CWE-73 CVE-2026-56390: GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %h GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the file

CVE-2020-24240 [MEDIUM] CWE-416 CVE-2020-24240: GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur

CVE-2020-14150 [MEDIUM] CVE-2020-14150: GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: ther GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug reports were intended to show that a crash may occur in Bison itself, not that a crash may occur in cod