GNU Bison contains a CWE-73 vulnerability where grammar directives such as %output and %header accept file paths without restriction, overriding caller-supplied output options. When processing attacker-controlled grammar files, this can lead to writing generated files to arbitrary writable filesystem locations, potentially overwriting files accessible to the Bison process. The maintainers addressed this issue in a specific commit (8d101c19d4d9aaedf83a448c925513742d4efcf0). Version 3.8.2 is confirmed vulnerable; other versions have not been tested but may also be affected. No official remediation level or patch release version is specified.

An attacker who can supply malicious grammar files to GNU Bison can cause the tool to write generated output files to arbitrary writable locations on the filesystem. This may lead to overwriting existing files accessible by the Bison process, potentially causing data loss or unauthorized modification of files. The vulnerability requires local access (AV:L) and user interaction (UI:A), with low privileges (PR:N) and no authentication required (AT:N). The overall impact is rated medium with a CVSS 4.6.

The maintainers have fixed the vulnerability in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, no official patch release version or remediation level has been provided. Users should update to the version containing this fix once it is officially released or apply the fix manually from the commit. Until then, avoid processing untrusted grammar files with vulnerable versions such as 3.8.2 to mitigate risk. Patch status is not yet confirmed in an official release — check the vendor advisory or project repository for current remediation guidance.