CVE-2026-91782: GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference

Published Sep 15, 2026

Updated

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elfx86allocatedynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.48 addresses this issue. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Upgrading the affected component is recommended.

Affected Software

1 affected component

GNU binutils=2.47

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GNU Binutils Dynamic Relocation Allocation (bfd/elfxx-x86.c, elf_x86_allocate_dynrelocs) to a version that resolves this vulnerability.
Fixed in 2.48Patch d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40

Event History

Sep 15, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems using GNU Binutils 2.47 are affected. Exploitation requires local access and low privileges, so remote-only attackers are not the stated threat model.

What is the likely impact if exploited?

The vulnerability causes a null pointer dereference in dynamic relocation allocation. The provided severity vector indicates an availability impact only, with no stated confidentiality or integrity impact.

Is an exploit available?

Yes. The exploit is public and may be used.

What should be done to remediate the issue?

Upgrade GNU Binutils to version 2.48. The listed patch identifiers are d1268210b6f6, 471130b39c0, 283d3198bed, 0a84e560216, and a692a633d40.