Description

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-14T17:17:56.800Z",
  "pubdate": "2026-09-14T17:17:56.800Z",
  "executiveSummary": "A critical vulnerability has been identified in the bfd_putl64 function within the GNU Binutils 2.47 component ld, specifically located in bfd/libbfd.c. The vulnerability manifests as a null pointer dereference, which can lead to application crashes or potential denial-of-service conditions.\nThis issue is classified as a memory safety flaw. Successful exploitation of this vulnerability requires an attacker to have local access to the system. While the vulnerability is currently unpatched and the project maintainers have not yet provided a formal response to the bug report, functional exploit code is publicly available, increasing the risk of exploitation for systems utilizing this version of Binutils.\nThe primary risk implication is the compromise of the integrity and availability of the affected Binutils component. Because Binutils is foundational to the development and execution of binaries on many Linux-based systems, this flaw could be leveraged to destabilize critical processes or development environments. Given the existence of public exploits, this vulnerability should be treated as a significant risk to local environments.\nThe attack is characterized by the manipulation of binary files that trigger the faulty execution path within ld. Users are advised to monitor the upstream repository for forthcoming security patches or guidance.",
  "technicalDetails": "The vulnerability resides in the bfd_putl64 function, defined in the source file bfd/libbfd.c, which is a core component of the GNU Binutils library (libbfd). The bfd_putl64 function is responsible for writing a 64-bit value to a buffer in little-endian format. The root cause of the vulnerability is the improper handling of memory pointers when processing malformed binary inputs during the linking process.\nIn the context of the ld (GNU Linker) component, the vulnerability is triggered when the linker encounters a specially crafted object file or binary that causes the bfd_putl64 function to operate on an uninitialized or null pointer. Specifically, if the internal logic of the linker fails to validate the target memory address before the put operation, the application attempts to perform a write access to the null memory address space.\nThe exploitation flow follows these steps: 1) The attacker constructs a malicious object file or binary input containing structural metadata designed to bypass initial integrity checks within the linker's input parsing phase. 2) This crafted input is passed as an argument to the ld linker utility. 3) During the processing of the symbol tables or relocation entries, the linker invokes bfd_putl64. 4) Due to the state of the internal data structures, the pointer dereference logic evaluates to a null address. 5) The system triggers an illegal memory access, resulting in a segmentation fault and an immediate crash of the ld process.\nThe affected version is GNU Binutils 2.47. The vulnerability requires local access, meaning the attacker must be able to execute the linker or trigger a build process on the target system. Because the exploit is public, the complexity of crafting a payload is significantly reduced for an attacker who already possesses local shell access. The primary impact is denial-of-service through the abrupt termination of the linker process, which can halt build pipelines, disrupt automated system tasks, or crash applications relying on libbfd for runtime object processing.\nPost-exploitation behavior typically involves the immediate termination of the ld process. If the linker is integrated into a larger, automated build system, this can lead to cascading failures. Furthermore, if the system is designed to handle linker errors insecurely, the null pointer dereference could potentially be leveraged in more complex scenarios to bypass security controls if an attacker can manipulate the execution context of the parent process, though the primary observed behavior remains an application crash."
}