PatchTheCVECVE-2026-56389: GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handli
33
Routine
HIGH 8.6DOWNGRADE
CVE-2026-56389 is a high-severity flaw (CVSS 8.6) affecting bison. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 8.6 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2026-07-29 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
gnu bison DOWNGRADE
Affected: 3.8.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.8.2
1. Check installed version
apt-cache policy bison || rpm -q bison || bison --version
2. No fixed release: DOWNGRADE to a release before 3.8.2 (Debian / Ubuntu)
apt-cache madison bison
sudo apt install bison=<VERSION_BEFORE_3.8.2>
sudo apt-mark hold bison
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list bison
sudo dnf downgrade bison-<VERSION_BEFORE_3.8.2>
sudo dnf versionlock add bison
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Advisories and coverage
Official advisories
- CERT Polska: Vulnerabilities in GNU Bison software 2026-07-29
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-56390 MEDIUM 6.3 DOWNGRADE GNU Bison improperly handles grammar‑defined output paths