Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90802GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference

Medium 4.4

In plain English

A medium-severity null pointer dereference in Binutils from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	binutils	no fix listed	DEBIAN-CVE-2026-90802
Debian:13	binutils	no fix listed	DEBIAN-CVE-2026-90802
Debian:14	binutils	no fix listed	DEBIAN-CVE-2026-90802
Ubuntu:22.04:LTS	binutils	no fix listed	UBUNTU-CVE-2026-90802
Ubuntu:24.04:LTS	binutils	no fix listed	UBUNTU-CVE-2026-90802
Ubuntu:26.04:LTS	binutils	no fix listed	UBUNTU-CVE-2026-90802
Ubuntu:26.10	binutils	no fix listed	UBUNTU-CVE-2026-90802

Affected products (as reported)

Vendor	Product	Versions
GNU	Binutils	2.47

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-403304 | GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference vdb-entry, technical-description
VDB-403304 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-90802 | CVE Analysis and Report third-party-advisory
Submit #920277 | GNU Binutils 2.47 (version date 20260726) NULL Pointer Dereference third-party-advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=34443 issue-tracking
https://github.com/r1ck9-2q/cve_summit/blob/main/SEGV%20in%20%60bfd_putl64%60%20(bfdlibbfd.c989)%20during%20relocation%20output%20via%20malformed%20ELF.md exploit
https://www.gnu.org/ broken-link, product