Vulnerabilities

GNU Binutils 2.47 contains a null pointer dereference (CWE-476) in the function elf_x86_allocate_dynrelocs in bfd/elfxx-x86.c, part of the dynamic relocation allocation logic used when linking x86 binaries. A local attacker can trigger the flaw by having the linker process specially crafted input, causing the linking tool to crash. The impact is limited to availability of the tool — there is no code execution or data compromise per the CVSS 4.0 vector (VA:L only), which scores the issue low at 1.9. Anyone building or linking x86 binaries with GNU Binutils 2.47 — developers, CI/CD build servers, and distro/embedded toolchains — is affected. A public proof-of-concept is available via the sourceware bug tracker, though EPSS puts 30-day exploitation probability at just 0.1% and the issue is not in CISA KEV.

Do: Upgrade GNU Binutils to version 2.48, or apply the upstream patch (commits d1268210b6f6, 471130b39c0, 283d3198bed, 0a84e560216, a692a633d40) via your distribution's package updates. Check your linker version with 'ld --version' on build hosts and CI runners, and treat untrusted object files or archives as a trigger for build-tool crashes until patched.

GNU Binutils 2.47 contains a null pointer dereference (CWE-476) in the bfd_elf_set_group_contents function of bfd/elf.c, which handles ELF SHT_GROUP sections. A local attacker with low privileges can supply a manipulated ELF file so that, when it is processed by binutils tools, the vulnerable code dereferences a null pointer. The practical impact is a crash of the affected binutils utility (denial of service), consistent with the low CVSS 4.0 score of 1.9 and low impact ratings across confidentiality, integrity, and availability. Anyone running binutils 2.47 that processes untrusted or attacker-controlled ELF files — for example developers, build farms, CI pipelines, and multi-tenant environments — is potentially affected. A proof of concept has been published in the upstream sourceware bug tracker (issue 34451); the project was notified via that report but has not yet responded, and there is no evidence of in-the-wild exploitation (EPSS 0.2%, not in CISA KEV).

Do: No official fix is available yet, so monitor sourceware bug 34451 and your distribution's security feed for a patched binutils release and upgrade as soon as one ships. Until then, avoid running binutils 2.47 tools (linker/binary utilities using the affected ELF code path) on untrusted or attacker-supplied ELF files, especially in shared or multi-tenant build and CI environments. Check installed binutils version to confirm exposure to 2.47 specifically.