CVE-2026-91782

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.48 addresses this issue. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Upgrading the affected component is recommended.

• CWE-404
• CWE-476

• https://github.com/Ech06/CVE_submit/tree/main/bugzilla/pocs/34448Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=34448Exploit, Third Party Advisory
• https://vuldb.com/cve/CVE-2026-91782Third Party Advisory
• https://vuldb.com/submit/933335Exploit
• https://vuldb.com/vuln/404053Permissions Required
• https://vuldb.com/vuln/404053/ctiPermissions Required
• https://www.gnu.org/Product

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91774Yao through v1.0.0-rc22 authenticates but fails to authorize…4.3
• CVE-2026-91778In affected versions of Octopus Server, users with certain s…7.2
• CVE-2026-91779A security flaw has been discovered in GNU Binutils 2.47. Th…3.3
• CVE-2026-9178The WP Forms Connector plugin for WordPress is vulnerable to…7.5
• CVE-2026-91780A weakness has been identified in GNU Binutils 2.47. This im…3.3
• CVE-2026-91781A security vulnerability has been detected in GNU Binutils 2…3.3
• CVE-2026-91786A flaw was found in GNOME Shell. When processing icons from …6.1
• CVE-2026-9179The WP Forms Connector plugin for WordPress is vulnerable to…7.5
• CVE-2026-9180The MotoPress Appointment Booking plugin for WordPress is vu…5.3
• CVE-2026-9181Esri ArcGIS Server contains a directory traversal vulnerabil…7.5
• CVE-2026-91819Affected versions of MISP rely on CakePHP request-method ove…6.9
• CVE-2026-9182Esri ArcGIS Server contains an unrestricted file upload vuln…9.8