CVE-2026-90830: gnu binutils Improper Resource Shutdown or Release
Vulnerability summary
CVE-2026-90830 is a medium (CVSS 5.3) Improper Resource Shutdown or Release vulnerability in gnu binutils. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 14-09-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a bug report but has not responded yet.
CVSS metrics
12 scores · 6 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST4.3MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
+0.01 pp
From 0.16% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- binutilsAll versions (No fix recorded)
- binutils-arm-none-eabiAll versions (No fix recorded)
- binutils-arm-none-eabi-docAll versions (No fix recorded)
- binutils-devAll versions (No fix recorded)
- binutils-docAll versions (No fix recorded)
Wolfi4 products
- binutilsAll versions (No fix recorded)
- binutils-devAll versions (No fix recorded)
- binutils-docAll versions (No fix recorded)
- binutils-goldAll versions (No fix recorded)
Debian1 product
- binutilsAll versions (No fix recorded)
Gnu1 product
- binutils2.47
Ubuntu1 product
- binutilsAll versions (No fix recorded)
5 vendors · 13 products
References
12 links- sourceware.org/bugzilla/attachment.cgi?id=16884ExploitREPORTEVIDENCEThird Party AdvisoryIssue Tracking
