CVE-2026-90830: GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function bfdwritemergedsection of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require user interaction or elevated privileges?
The available CVSS data indicates that exploitation requires local access and low privileges, but no user interaction. It does not indicate that administrative privileges are required.
What is the likely impact if exploitation succeeds?
The CVSS vector assigns low impacts to confidentiality, integrity, and availability. The reported flaw is a null pointer dereference in the Section Merge component.
Is a vendor fix or workaround available?
The provided information does not identify a fix or workaround. It states that the project was notified through a bug report but had not responded at the time of publication.