CVE-2026-56390: Arbitrary Output Location Change in GNU Bison
Arbitrary Output Location Change in GNU Bison
Other sources
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process.
Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.2-2 - Upgrade
Upgrade
GNU Bisonto a version that resolves this vulnerability.Fixed in 3.8.2Patch 8d101c19d4d9aaedf83a448c925513742d4efcf0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56390?
The severity of CVE-2026-56390 is medium with a CVSS score of 4.6.
How do I fix CVE-2026-56390?
To fix CVE-2026-56390, ensure that you are using a patched version of GNU Bison that addresses this vulnerability.
What type of vulnerability is described in CVE-2026-56390?
CVE-2026-56390 is an arbitrary output location change vulnerability in GNU Bison.
Who is affected by CVE-2026-56390?
Users of GNU Bison who rely on grammar directives for output paths are affected by CVE-2026-56390.
What can attackers achieve with CVE-2026-56390?
Attackers can exploit CVE-2026-56390 to direct generated output files to arbitrary locations by manipulating grammar directives.