CVE-2026-90830 is a vulnerability in GNU Binutils 2.47 affecting the _bfd_write_merged_section function in the bfd/merge.c source file. The flaw results in a null pointer dereference when merging sections, which can be triggered by a local attacker. This vulnerability could lead to denial of service or other impacts related to application stability. The vulnerability was responsibly disclosed to the project, but no fix or official advisory has been published. Public exploit details are available, though no active exploitation has been observed.

The vulnerability allows a local attacker to cause a null pointer dereference in GNU Binutils 2.47, potentially leading to denial of service or application crashes. Confidentiality, integrity, and availability impacts are rated low to moderate based on the CVSS vector (C:L/I:L/A:L). There is no evidence of remote exploitation or privilege escalation from the provided data.

No official fix or patch is currently available from the vendor. Since the vulnerability requires local access, restricting local user permissions and monitoring usage of binutils may reduce risk. Check the vendor advisory or project repository regularly for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.