Vulnerability record · CVE-2026-90828 · published 14 September 2026

CVE-2026-90828: Gnu binutils improper resource shutdown vulnerability

Gnu · Binutils

A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

1.9 CVSS 4.0 Low EPSS 0.19% · top 92.5% CWE-404 · Improper resource shutdownCWE-476 · NULL pointer dereference

1.9CVSS 4.0 base score, v2 4.3

0.19%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

7References, 1 tagged exploit

21 Sep 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Binutils Gnu

References

Link	Tags
https://sourceware.org/bugzilla/attachment.cgi?id=16882	Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=34450	ExploitIssue TrackingThird Party Advisory
https://vuldb.com/cve/CVE-2026-90828	Third Party AdvisoryVDB Entry
https://vuldb.com/submit/925227	Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/403330	Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/403330/cti	Permissions RequiredVDB Entry
https://www.gnu.org/	Product

Track CVE-2026-90828 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-12699Gnu binutils out-of-bounds write vulnerabilityfinish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified o…EPSS 4.5%23 Jun 2018 9.8CVE-2017-7614Gnu binutils null pointer dereference vulnerabilityelflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" un…EPSS 3.8%9 Apr 2017 9.8CVE-2014-9939Gnu binutils memory buffer overflow vulnerabilityihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.EPSS 2.3%21 Mar 2017 9.1CVE-2017-7226Gnu binutils out-of-bounds read vulnerabilityThe pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-b…EPSS 2.5%22 Mar 2017 9.1CVE-2017-6969Gnu binutils out-of-bounds read vulnerabilityreadelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger pro…EPSS 3.7%17 Mar 2017 8.8CVE-2020-19726Gnu binutils uncontrolled resource consumption vulnerabilityAn issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a…EPSS 0.75%22 Aug 2023 7.8CVE-2026-6846Gnu binutils heap-based buffer overflow vulnerabilityA flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Form…EPSS 0.20%22 Apr 2026 7.8CVE-2022-44840Gnu binutils out-of-bounds write vulnerabilityHeap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.EPSS 0.49%22 Aug 2023

Source: NIST National Vulnerability Database (record CVE-2026-90828), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.