CVE-2026-90802: gnu binutils Improper Resource Shutdown or Release
Vulnerability summary
CVE-2026-90802 is a medium (CVSS 4.8) Improper Resource Shutdown or Release vulnerability in gnu binutils. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 14-09-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
CVSS metrics
12 scores · 6 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- NVDNIST3.2LowAV:L/AC:L/Au:S/C:N/I:P/A:P
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
+0.06 pp
From 0.13% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundCve Summit
Maturity: poc
Exploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- binutilsAll versions (No fix recorded)
- binutils-arm-none-eabiAll versions (No fix recorded)
- binutils-arm-none-eabi-docAll versions (No fix recorded)
- binutils-devAll versions (No fix recorded)
- binutils-docAll versions (No fix recorded)
Wolfi4 products
- binutilsAll versions (No fix recorded)
- binutils-devAll versions (No fix recorded)
- binutils-docAll versions (No fix recorded)
- binutils-goldAll versions (No fix recorded)
Debian1 product
- binutilsAll versions (No fix recorded)
Gnu1 product
- binutils2.47
Ubuntu1 product
- binutilsAll versions (No fix recorded)
5 vendors · 13 products
