CVE-2026-90829

MediumCVSS 5.3/10Last modified Sep 16, 2026

Description

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
GNU	Binutils	2.47

References

https://sourceware.org/bugzilla/attachment.cgi?id=16883Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=34451Exploit, Third Party Advisory
https://vuldb.com/cve/CVE-2026-90829Permissions Required
https://vuldb.com/submit/925228Permissions Required
https://vuldb.com/vuln/403331Permissions Required
https://vuldb.com/vuln/403331/ctiPermissions Required
https://www.gnu.org/Product
https://sourceware.org/bugzilla/show_bug.cgi?id=34451Exploit, Third Party Advisory

Timeline

Published: Sep 14, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-90834.9A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary f CVE-2026-908305.3A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c CVE-2026-908315.3A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c CVE-2026-908324.3bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verifie CVE-2026-908337.8The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with a single test, (offs CVE-2026-908345.5The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation CVE-2026-908353.5A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java o CVE-2026-90846.0MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim w CVE-2026-908407.3A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /applicatio CVE-2026-908417.3A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functional CVE-2026-908423.7A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-908438.3A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the functio