CVE-2026-91780: 
NixOS vulnerability analysis and mitigation

CVE-2026-91780 is a null pointer dereference vulnerability in GNU Binutils 2.47, specifically affecting the elf_link_add_object_symbols function in bfd/elflink.c. The vulnerability was disclosed on September 15, 2026, and affects only GNU Binutils version 2.47. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low), reflecting its local-only, limited-availability-impact nature (GitHub Advisory, VulDB).

The root cause is a null pointer dereference (CWE-476) combined with improper resource shutdown or release (CWE-404) in the ELF linking logic within bfd/elflink.c. An attacker with local access and low privileges can manipulate ELF object files passed to the linker, triggering the dereference in elf_link_add_object_symbols and causing the process to crash. No network access or user interaction is required; the attacker only needs the ability to invoke the linker or a tool that uses the affected BFD library. Proof-of-concept object files (bug_5.o, bug_6.o, bug_16.o) have been publicly posted to a GitHub repository and a bug report filed at the GNU Binutils Bugzilla (GitHub PoC, Bugzilla).

Successful exploitation causes a denial-of-service condition by crashing the GNU Binutils linker (ld) or any tool that internally invokes the affected BFD library function. There is no impact on confidentiality or integrity; only availability is affected, and only within the scope of the vulnerable process itself. The impact is limited to build and development environments where Binutils 2.47 is in use, and there is no evidence of lateral movement potential or data exposure risk (GitHub Advisory, VulDB).

Proof-of-concept ELF object files are publicly available in a GitHub repository, lowering the bar for exploitation (GitHub PoC). However, there is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the EPSS score is 0.0, indicating very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain PoC artifacts: Download the publicly available malicious ELF object files (bug_5.o, bug_6.o, or bug_16.o) from the public GitHub repository at https://github.com/Ech06/CVE_submit/tree/main/bugzilla/pocs/34447.
2. Identify target: Confirm the target system is running GNU Binutils 2.47 (e.g., via ld --version).
3. Invoke the linker: As a local user with low privileges, pass the malicious object file to the linker or a tool using the BFD library, for example: ld bug_5.o or objcopy bug_5.o output.o.
4. Trigger crash: The elf_link_add_object_symbols function in bfd/elflink.c dereferences a null pointer when processing the crafted ELF input, causing the linker process to crash with a segmentation fault, resulting in a denial-of-service condition (GitHub PoC, Bugzilla).

• Process: Unexpected segmentation fault or crash of ld, objcopy, objdump, or other Binutils tools; core dump files generated in the working directory associated with these processes.
• File System: Presence of unusual or externally sourced .o (ELF object) files, particularly those named bug_5.o, bug_6.o, or bug_16.o, in build directories or temporary locations.
• Logs: System logs (e.g., /var/log/syslog or journalctl) recording segfault signals for ld or BFD-linked tools; application build logs showing unexpected linker termination without a standard error message.

No official patch from the GNU Binutils project has been released as of the disclosure date, as the project had not yet responded to the bug report (GitHub Advisory). As interim mitigations, administrators should restrict local access to systems running GNU Binutils 2.47, particularly limiting which unprivileged users can invoke the linker or related tools. Organizations should monitor the GNU Binutils Bugzilla and official release channels for a patched version, and consider downgrading to a prior stable Binutils release if operationally feasible.