CVE catalog

CVE-2026-91780

A weakness has been identified in GNU Binutils 2.47…

A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Severity: Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Published: Sep 14, 2026, 10:00:00 PM UTC
Updated: Sep 15, 2026, 9:16:44 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.17% · Oct 29, 2026

Projects and upstream resources

[binutils][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debiantrixie	binutils	`2.44-3`	Affected	[CVE-2026-91780]
Debiansid	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debiansid	binutils	`2.47.50.20261021-1`	Affected	[CVE-2026-91780]
Debianforky	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debianforky	binutils	`2.47.50.20261021-1`	Affected	[CVE-2026-91780]
Debianbookworm	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debianbookworm	binutils	`2.40-2`	Affected	[CVE-2026-91780]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debianbookworm	binutils	`2.40-2`	Affected	[CVE-2026-91780]
Debianforky	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debianforky	binutils	`2.47.50.20261021-1`	Affected	[CVE-2026-91780]
Debiansid	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debiansid	binutils	`2.47.50.20261021-1`	Affected	[CVE-2026-91780]
Debiantrixie	binutils	Not reported	AffectedDistribution reports no fix	[CVE-2026-91780]
Debiantrixie	binutils	`2.44-3`	Affected	[CVE-2026-91780]

Original provider fields

{
  "package_releases": [
    {
      "name": "binutils",
      "status": "vulnerable",
      "release": "sid",
      "version": "2.47.50.20261021-1"
    },
    {
      "name": "binutils",
      "status": "vulnerable",
      "release": "forky",
      "version": "2.47.50.20261021-1"
    },
    {
      "name": "binutils",
      "status": "vulnerable",
      "release": "trixie",
      "version": "2.44-3"
    },
    {
      "name": "binutils",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.40-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "binutils",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "binutils",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91780",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-91780",
      "provider_updated_at": "2026-09-16T15:28:30.983"
    }
  ]
}

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[binutils]Unknown
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-aarch64-linux-gnu]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-aarch64-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-alpha-linux-gnu]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-alpha-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-arc-linux-gnu]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-arc-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-arm-linux-gnueabi]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-arm-linux-gnueabi-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-arm-linux-gnueabihf]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-arm-linux-gnueabihf-dbg]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-common]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-dev]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-doc]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · all · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · all · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-for-build]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · all · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · all · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-for-host]Unknown
Source package: [binutils]
Details (2)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
- 2.40-2 · arm64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-hppa64-linux-gnu]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-hppa64-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-hppa-linux-gnu]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14
[binutils-hppa-linux-gnu-dbg]Unknown
Source package: [binutils]
Details (1)
- 2.40-2 · amd64 · bookworm
  Unknown
  Version impact unknown
  nvd · binutils · debian · bookworm; pypi · binutils · debian · 12; pypi · binutils · debian · 13; pypi · binutils · debian · 14

Next results

Observed: Oct 29, 2026, 9:43:15 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]