CVE-2026-91782 GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference

What is CVE-2026-91782?

CVE-2026-91782 is a medium-severity vulnerability in Gnu Binutils, published on 15 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.48 addresses this issue. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Upgrading the affected component is recommended.

Weakness: CWE-476, CWE-404

Which versions are affected by CVE-2026-91782?

It affects 1 product.

Products include Gnu Binutils.

How do I fix CVE-2026-91782?

Upgrade to a fixed version.

Is CVE-2026-91782 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91782 exists.

Other vulnerabilities in Gnu Binutils

• CVE-2017-7614 Null dereference in n/a Critical 9.8
• CVE-2014-9939 Memory corruption in n/a Critical 9.8
• CVE-2017-7226 Information disclosure in n/a Critical 9.1
• CVE-2017-6969 Information disclosure in n/a Critical 9.1
• CVE-2020-19726 Denial of service in n/a High 8.8

All Gnu Binutils vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-91782, DEBIAN-CVE-2026-91782, ECHO-7679-34eb-5703, GHSA-vqfr-4h6g-3q8x, UBUNTU-CVE-2026-91782.