CVE-2026-91779

LowCVSS 3.3/10Last modified Sep 16, 2026

Description

A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the component Eh Frame Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
GNU	Binutils	2.47

References

https://github.com/Ech06/CVE_submit/blob/main/bugzilla/issues/34446.mdThird Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=34446Third Party Advisory
https://vuldb.com/cve/CVE-2026-91779Third Party Advisory
https://vuldb.com/submit/933333Third Party Advisory
https://vuldb.com/vuln/404050Third Party Advisory
https://vuldb.com/vuln/404050/ctiPermissions Required
https://www.gnu.org/Product

Timeline

Published: Sep 15, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-91787.5The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin regi CVE-2026-917803.3A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Execut CVE-2026-917813.3A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/el CVE-2026-917823.3A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd CVE-2026-917844.8cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill CVE-2026-917866.1A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's decl CVE-2026-917885.5When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the speci CVE-2026-917897.8Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. CVE-2026-91797.5The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST en CVE-2026-917907.8When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are ma CVE-2026-917917.8When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript tri CVE-2026-917927.8When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotati