CVE-2026-91782: 
NixOS vulnerability analysis and mitigation

CVE-2026-91782 is a null pointer dereference vulnerability in GNU Binutils 2.47, specifically in the elf_x86_allocate_dynrelocs function within bfd/elfxx-x86.c, which handles Dynamic Relocation Allocation for x86 ELF binaries. The vulnerability was published on September 15, 2026, and affects only GNU Binutils version 2.47; version 2.48 is unaffected. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Advisory, Feedly).

The root cause is a null pointer dereference (CWE-476) combined with improper resource shutdown or release (CWE-404) in the elf_x86_allocate_dynrelocs function of bfd/elfxx-x86.c in GNU Binutils 2.47. An attacker with low-privilege local access can manipulate inputs to the Dynamic Relocation Allocation component to trigger a null pointer dereference, causing the affected binutils process to crash. The attack requires no user interaction and has low complexity. A proof-of-concept has been publicly disclosed via a GitHub repository containing sample object files (bug_1.o, bug_18.o, bug_4.o) linked to GNU Bugzilla issue #34448 (GitHub PoC, GitHub Advisory).

Successful exploitation results in a denial-of-service condition limited to the affected binutils process — specifically, a crash due to null pointer dereference. There is no impact on confidentiality or integrity; only availability of the binutils toolchain process is affected. The scope is limited to local build and compilation environments where GNU Binutils 2.47 is in use, with no evidence of lateral movement potential or data exposure risk (GitHub Advisory, Feedly).

A public proof-of-concept exists in the form of sample object files hosted on GitHub (linked to GNU Bugzilla #34448), making the vulnerability reproducible by any local user (GitHub PoC). However, there is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.121% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Prerequisite: Obtain low-privilege local access to a system running GNU Binutils 2.47.
2. Obtain PoC: Download or craft a malicious ELF object file designed to trigger the null pointer dereference in elf_x86_allocate_dynrelocs (sample files such as bug_1.o, bug_18.o, and bug_4.o are publicly available at the GitHub PoC repository).
3. Trigger the vulnerability: Pass the malicious object file to a binutils tool (e.g., ld or another tool invoking bfd/elfxx-x86.c) that processes dynamic relocation allocation for x86 ELF binaries.
4. Observe crash: The elf_x86_allocate_dynrelocs function dereferences a null pointer, causing the binutils process to crash with a segmentation fault, resulting in a denial-of-service condition for the build/link operation (GitHub PoC, GitHub Advisory).

• Process: Unexpected segmentation fault or crash of ld, objdump, or other binutils processes when processing ELF object files; core dump files generated by binutils tools in build directories.
• File System: Presence of unusual or externally sourced ELF object files (e.g., bug_1.o, bug_18.o, bug_4.o) in build or compilation directories.
• Logs: System logs (e.g., /var/log/syslog or dmesg) showing segfault entries referencing binutils executables such as ld or as.

Upgrade GNU Binutils to version 2.48 or later, which addresses this vulnerability via commits d1268210b6f6, 471130b39c0, 283d3198bed, 0a84e560216, and a692a633d40. No configuration-based workaround is documented; upgrading is the only recommended remediation. Organizations should prioritize this update on systems where binutils is accessible to local users, particularly in shared build or CI/CD environments (GitHub Advisory, GNU Bugzilla).