CVE catalog

CVE-2026-56390

Severity: Medium · CVSS 5.6CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Published: Jul 29, 2026, 9:40:03 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.18% · Oct 27, 2026

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	bison	sid	`2:3.8.2+dfsg-1`	vulnerable
Debian	bison	forky	`2:3.8.2+dfsg-1`	vulnerable
Debian	bison	trixie	`2:3.8.2+dfsg-1`	vulnerable
Debian	bison	bookworm	`2:3.8.2+dfsg-1`	vulnerable
Cpe	bison	Not reported	Not reported	unknown
Ubuntu	bison	16.04	`2:3.0.2.dfsg-2`	vulnerable
Ubuntu	bison	16.04	`2:3.0.4.dfsg-1`	vulnerable
Ubuntu	bison	18.04	`2:3.0.4.dfsg-1build1`	vulnerable
Ubuntu	bison	20.04	`2:3.4.1+dfsg-4`	vulnerable
Ubuntu	bison	20.04	`2:3.4.2+dfsg-1`	vulnerable
Ubuntu	bison	20.04	`2:3.5.1+dfsg-1`	vulnerable
Ubuntu	bison	22.04	`2:3.7.6+dfsg-1build1`	vulnerable
Ubuntu	bison	22.04	`2:3.8.2+dfsg-1`	vulnerable
Ubuntu	bison	22.04	`2:3.8.2+dfsg-1build1`	vulnerable
Ubuntu	bison	22.04	`2:3.8.2+dfsg-1ubuntu0.22.04.1`	vulnerable
Ubuntu	bison	24.04	`2:3.8.2+dfsg-1build1`	vulnerable
Ubuntu	bison	24.04	`2:3.8.2+dfsg-1build2`	vulnerable
Ubuntu	bison	24.04	`2:3.8.2+dfsg-1ubuntu0.24.04.1`	vulnerable
Ubuntu	bison	26.10	`2:3.8.2+dfsg-1build4`	vulnerable
Ubuntu	bison	26.10	`2:3.8.2+dfsg-1ubuntu1`	vulnerable
Ubuntu	bison	26.04	`2:3.8.2+dfsg-1build3`	vulnerable
Ubuntu	bison	26.04	`2:3.8.2+dfsg-1build4`	vulnerable
Ubuntu	bison	26.04	`2:3.8.2+dfsg-1ubuntu0.26.04.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	bison	source	sid	`(unfixed)`	not yet assigned	Not reported	[1143158]
Debian	bison	source	forky	`(unfixed)`	not yet assigned	Not reported	[1143158]
Debian	bison	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1143158]
Debian	bison	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1143158]

[Debian bug #1143158]

Notes

[trixie] bison: Minor issue [bookworm] bison: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[bison]Affected
Source package: [bison]
Details (2)
- 2:3.8.2+dfsg-1+b1 · amd64 · bookworm
  Affected
  nvd · bison · debian · bookworm; nvd · bison · debian · 12
- 2:3.8.2+dfsg-1+b1 · arm64 · bookworm
  Affected
  nvd · bison · debian · bookworm; nvd · bison · debian · 12
[libbison-dev]Affected
Source package: [bison]
Details (2)
- 2:3.8.2+dfsg-1+b1 · amd64 · bookworm
  Affected
  nvd · bison · debian · bookworm; nvd · bison · debian · 12
- 2:3.8.2+dfsg-1+b1 · arm64 · bookworm
  Affected
  nvd · bison · debian · bookworm; nvd · bison · debian · 12

[Debian 13 (Trixie)]

[bison]Affected
Source package: [bison]
Details (2)
- 2:3.8.2+dfsg-1+b2 · amd64 · trixie
  Affected
  nvd · bison · debian · 13
- 2:3.8.2+dfsg-1+b2 · arm64 · trixie
  Affected
  nvd · bison · debian · 13
[libbison-dev]Affected
Source package: [bison]
Details (2)
- 2:3.8.2+dfsg-1+b2 · amd64 · trixie
  Affected
  nvd · bison · debian · 13
- 2:3.8.2+dfsg-1+b2 · arm64 · trixie
  Affected
  nvd · bison · debian · 13

Observed: Oct 25, 2026, 6:25:27 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]