CVE-2026-91781: 
NixOS vulnerability analysis and mitigation

CVE-2026-91781 is a null pointer dereference vulnerability in GNU Binutils 2.47, specifically within the elf_x86_64_common_section_index function in bfd/elf64-x86-64.c (the ELF Section Handler component). The vulnerability was published on September 15, 2026, and affects only GNU Binutils version 2.47; version 2.48 is unaffected. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Advisory, VulDB).

The root cause is a null pointer dereference (CWE-476) combined with improper resource shutdown or release (CWE-404) in the elf_x86_64_common_section_index function within bfd/elf64-x86-64.c of the GNU Binutils Binary File Descriptor (BFD) library. An attacker with low local privileges can trigger the flaw by supplying a specially crafted ELF object file (such as the PoC bug_0.o available in the public repository) to a Binutils tool that processes ELF sections, causing a null pointer to be dereferenced and the application to crash. No network access or user interaction is required beyond local execution privileges. The upstream fix is identified by commit 7322e9bc30cb282575a701c307851fd3d66fee68 in the binutils-gdb repository (GitHub Advisory, Sourceware Bugzilla, Sourceware Patch).

Successful exploitation results in a denial of service — specifically, a crash of the affected Binutils application (e.g., objdump, readelf, or ld) due to the null pointer dereference. There is no impact on confidentiality or integrity; only availability is affected, and only at a low level since the crash is limited to the invoking process rather than the broader system. The vulnerability does not enable code execution, privilege escalation, or lateral movement (GitHub Advisory, VulDB).

A proof-of-concept ELF object file (bug_0.o) has been publicly disclosed in a GitHub repository, confirming the vulnerability is exploitable in practice (GitHub PoC). However, there is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.12% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and exploitation is not automatable due to the local access requirement (GitHub Advisory, VulDB).

1. Obtain local access: Gain low-privileged local access to a system running GNU Binutils 2.47.
2. Prepare the malicious ELF file: Craft or obtain a specially malformed ELF object file (e.g., the publicly available bug_0.o from the PoC repository) designed to trigger the null pointer dereference in elf_x86_64_common_section_index.
3. Invoke a Binutils tool: Execute a Binutils utility that processes ELF sections against the malicious file, for example: objdump -d bug_0.o or readelf -S bug_0.o.
4. Trigger the crash: The elf_x86_64_common_section_index function in bfd/elf64-x86-64.c dereferences a null pointer when processing the malformed ELF section data, causing the Binutils process to crash (denial of service) (GitHub PoC, Sourceware Bugzilla).

• File System: Presence of unexpected or externally sourced ELF object files (e.g., bug_0.o) in user-accessible directories on systems running GNU Binutils 2.47.
• Logs: Crash reports or core dumps associated with Binutils processes (objdump, readelf, ld, nm) referencing a segmentation fault or null pointer dereference in bfd/elf64-x86-64.c.
• Process: Abnormal termination (SIGSEGV) of Binutils utilities when processing ELF files, particularly if triggered by a low-privileged user account with no legitimate build or analysis activity.

The primary remediation is to upgrade GNU Binutils to version 2.48 or later, which includes the fix introduced by commit 7322e9bc30cb282575a701c307851fd3d66fee68. If an immediate upgrade is not feasible, restrict local access to systems running Binutils 2.47 and avoid processing untrusted ELF files with affected Binutils tools. No configuration-based workaround has been identified beyond access control (GitHub Advisory, Sourceware Patch).