CVE-2026-90828 is a vulnerability in GNU Binutils version 2.47 involving the elf_orphan_compatible function within the ld/ldelf.c file. The flaw leads to a null pointer dereference when manipulated, potentially causing a denial of service or other impacts related to memory corruption. Exploitation requires local access with low privileges and no user interaction. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. Although an exploit has been publicly released, the GNU Binutils project has not yet responded or provided a patch.

The vulnerability can cause a null pointer dereference, which may lead to denial of service or other memory corruption impacts affecting confidentiality, integrity, and availability at a low level. Exploitation requires local access with low privileges, limiting the attack surface. The availability of public exploit code increases the risk of exploitation despite the lack of vendor response.

No official patch or remediation has been provided by the vendor as of the current information. Users should monitor the GNU Binutils project for updates and consider restricting local access to trusted users only. Since the vulnerability requires local access, limiting user privileges and access controls can reduce risk until a fix is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.