CVE-2026-90829: gnu binutils Improper Resource Shutdown or Release
Vulnerability summary
CVE-2026-90829 is a medium (CVSS 5.3) Improper Resource Shutdown or Release vulnerability in gnu binutils. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.2% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 14-09-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.
CVSS metrics
12 scores · 6 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST4.3MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.01 pp
From 0.17% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- binutilsAll versions (No fix recorded)
- binutils-arm-none-eabiAll versions (No fix recorded)
- binutils-arm-none-eabi-docAll versions (No fix recorded)
- binutils-devAll versions (No fix recorded)
- binutils-docAll versions (No fix recorded)
Wolfi4 products
- binutilsAll versions (No fix recorded)
- binutils-devAll versions (No fix recorded)
- binutils-docAll versions (No fix recorded)
- binutils-goldAll versions (No fix recorded)
Debian1 product
- binutilsAll versions (No fix recorded)
Gnu1 product
- binutils2.47
Ubuntu1 product
- binutilsAll versions (No fix recorded)
5 vendors · 13 products
