CVE-2026-91780

GNU Binutils through 2.45.1 contains a denial-of-service vulnerability in readelf when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning without forward progress, resulting in a non-terminating output loop requiring manual interruption. No evidence of memory corruption or code execution was observed.

GNU Binutils readelf through 2.45.1 contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw causes readelf to repeatedly print the same table output without progress, resulting in an unbounded output loop.

GNU Binutils through 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines, and an unexpected data length of zero triggers a fatal abort in byte_get_little_endian().

GNU Binutils through 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. The internal all_relocations array may remain partially uninitialized, and later process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. The impact is limited to denial of service; the issue is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in handling the debug_rnglists header causes objdump to repeatedly print the same warning and fail to terminate.

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This allows a local attacker to cause excessive resource consumption by supplying a malicious input file.

In GNU Binutils 2.43, the xstrdup function in xstrdup.c of the ld component causes a memory leak. The attack can be launched remotely but has high complexity and is difficult to exploit. The exploit has been publicly disclosed and may be used.

The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.

GNU Binutils 2.29.1 has a mishandling issue with certain global symbols in nm.c and objdump.c, which can lead to application crashes or denial of service.

The _bfd_coff_read_string_table function in the BFD library (libbfd) in GNU Binutils 2.29.1 does not properly validate the size of the external string table, which can lead to denial of service or buffer overflow.