CVE-2026-90831: GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-14 · updated 2026-09-16
Weakness: CWE-119

Description

A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component ELF String Table. The manipulation results in memory corruption. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

Affected products

GNU Binutils: 2.47

References

https://sourceware.org/bugzilla/attachment.cgi?id=16886
https://sourceware.org/bugzilla/show_bug.cgi?id=34454
https://vuldb.com/cve/CVE-2026-90831
https://vuldb.com/submit/925230
https://vuldb.com/vuln/403333
https://vuldb.com/vuln/403333/cti
https://www.gnu.org/

Get alerted when CVE-2026-90831 or the next vulnerability affects your stack