PatchTheCVECVE-2026-56390: GNU Bison improperly handles grammar‑defined output paths
24
Routine
MEDIUM 6.3DOWNGRADE
CVE-2026-56390 is a medium-severity flaw (CVSS 6.3) affecting bison. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of t
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 93%) |
| CISA exploited list | No |
| Weakness | CWE-73 |
| Published | 2026-07-29 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
gnu bison DOWNGRADE
Affected: 3.8.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.8.2
1. Check installed version
apt-cache policy bison || rpm -q bison || bison --version
2. No fixed release: DOWNGRADE to a release before 3.8.2 (Debian / Ubuntu)
apt-cache madison bison
sudo apt install bison=<VERSION_BEFORE_3.8.2>
sudo apt-mark hold bison
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list bison
sudo dnf downgrade bison-<VERSION_BEFORE_3.8.2>
sudo dnf versionlock add bison
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Advisories and coverage
Official advisories
- CERT Polska: Vulnerabilities in GNU Bison software 2026-07-29
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-56389 HIGH 8.6 DOWNGRADE GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handli