Description

A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-15T09:16:44.960Z",
  "pubdate": "2026-09-15T09:16:44.960Z",
  "executiveSummary": "A null pointer dereference vulnerability has been identified in GNU Binutils version 2.47, specifically within the elf_link_add_object_symbols function located in bfd/elflink.c.\nThis vulnerability is triggered when processing malformed ELF objects, potentially leading to a crash or denial-of-service condition.\nThe flaw necessitates local access, as the vulnerability resides in the object file processing logic of the BFD library. While the exploit is publicly available, the risk remains restricted to local execution environments where an attacker can supply malicious object files to the targeted Binutils utilities.\nThe project maintainers have been notified via a bug report; however, no official patch or vendor response is currently available. Users should exercise caution when processing untrusted ELF binaries and implement restrictive file system permissions to minimize the local attack surface.",
  "technicalDetails": "The vulnerability is situated within the BFD (Binary File Descriptor) library component of GNU Binutils, specifically inside the elf_link_add_object_symbols function in the bfd/elflink.c source file.\nThe root cause of the vulnerability is an inadequate validation or handling of internal object structures during the symbol linking process. When the elf_link_add_object_symbols function parses a maliciously crafted ELF file, it encounters a state where a pointer intended to reference a valid memory structure is instead assigned a NULL value.\nUpon subsequent dereference of this pointer without prior validation, the process triggers a segmentation fault, leading to an immediate termination of the utility executing the operation.\nThe attack flow requires an attacker to create a specially crafted ELF object file designed to trigger the specific path in the symbol adding logic that results in the NULL pointer assignment. Once this object is provided to a vulnerable version of a Binutils utility (such as ld, nm, or objdump), the application performs the link operation and triggers the dereference.\nBecause the vulnerability occurs during the static analysis or linking stage of binary processing, the impact is primarily Denial-of-Service (DoS) against the utility being used. Exploitation is restricted to local vectors, as the attacker must be able to invoke the binary tool against the malicious file on the local file system or via an interface that accepts user-provided binaries.\nThe vulnerability is deterministic in nature, meaning that the provided malformed ELF input consistently triggers the dereference when the specific code path is traversed. There is no requirement for specialized authentication beyond standard local user privileges; however, the impact is confined to the context of the user process executing the vulnerable tool. Post-exploitation impact is limited to the crash of the process, though research into whether this can be leveraged for further memory corruption or control flow redirection remains a point of concern in the context of publicly available exploits."
}