GNU Binutils ld NULL Pointer Dereference in bfd_elf_en_frame_section_offset (CWE-476)

Vulnerability Summary: NULL Pointer Dereference in in GNU Binutils ld Overview Type: NULL Pointer Dereference Trigger Scenario: During a relocatable link, when processing malicious -related relocations, the function dereferences a NULL pointer when parsing inconsistent CI/EDFE states, leading to a process crash. Severity: Medium CWE: CWE-476 (NULL Pointer Dereference) Scope of Impact Affected Components: GNU Binutils ld (binutils-gdb) Affected Versions: binutils 2.47 (release tarball version date 20260726) and dev snapshot 2.47/58.2626922 (commit 64a70623) Impact: Maliciously crafted object files can cause a crash during a relocatable link, resulting in a Denial of Service (DoS). Any build system, CI pipeline, or service that uses ld and is exposed to untrusted input files may be affected. Remedy In and the related query paths, rigorously validate the parsed CI/EDFE states: if the state is NULL or inconsistent with the input, return a linker error instead of proceeding to dereference; and add malicious input files to the AddressSanitizer regression test coverage. The upstream fix has not yet been committed (as of 2026-08-16, the status on Bugzilla is UNCONFIRMED, with no fix commit). Recommendations: Avoid running on untrusted object files directly, or upgrade promptly once the upstream fix is released. POC / Reproduction Code Build binutils-gdb Run the POC Expected Crash Output (AddressSanitizer) References Bugzilla issue 34446: https://sourceware.org/bugzilla/show_bug.cgi?id=34446 POC attachment (bug 9): https://sourceware.org/bugzilla/attachment.cgi?id=16874 Related earlier bug 33478: https://sourceware.org/bugzilla/show_bug.cgi?id=33478 Related earlier bug 33499: https://sourceware.org/bugzilla/show_bug.cgi?id=33499 Related write path bug 34445: https://sourceware.org/bugzilla/show_bug.cgi?id=34445 Affected versions: binutils 2.47 (version date 20260726) / dev snapshot commit 64a70623 Binutils repository: https://sourceware.org/git/binutils-gdb.git Reproduction materials (POC): https://github.com/Ech6/CVE_submittree/main/bugzilla/pocs/34446

Goal Reached Thanks to every supporter — we hit 100%!

GNU Binutils ld NULL Pointer Dereference in bfd_elf_en_frame_section_offset (CWE-476)

More from this source