CVE-2026-90830 — MEDIUM (5.3)

Vulnerability Description

A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Gnu	Binutils	2.47

Related Weaknesses (CWE)

CWE-404 CWE-476

References

https://sourceware.org/bugzilla/attachment.cgi?id=16884Third Party AdvisoryIssue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=34452Third Party AdvisoryIssue Tracking
https://vuldb.com/cve/CVE-2026-90830Third Party Advisory
https://vuldb.com/submit/925229Third Party Advisory
https://vuldb.com/vuln/403332Third Party Advisory
https://vuldb.com/vuln/403332/ctiPermissions Required
https://www.gnu.org/Product

FAQ

What is CVE-2026-90830?

CVE-2026-90830 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to nu...

How severe is CVE-2026-90830?

CVE-2026-90830 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-90830?

Check the references section above for vendor advisories and patch information. Affected products include: Gnu Binutils.