A vulnerability has been found in GNU Bison up to 3.8.2. This impacts the function code_free of the file src/scan-code.c. The manipulation leads to double free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The actual existence of this vulnerability is currently in question. The issue could not be reproduced from a GNU Bison 3.8.2 tarball run in a Fedora 42 container.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| https://vuldb.com/?id.319230 | vdb entry technical description |
| https://vuldb.com/?ctiid.319230 | permissions required signature |
| https://vuldb.com/?submit.622300 | third party advisory |
| https://github.com/akimd/bison/issues/115 | issue tracking |
| https://drive.google.com/file/d/123Qe44FaC-GP88dWNl9-6H4jLWUcXYNZ/view?usp=drive_link | exploit |
| https://www.gnu.org/ | product |