GNU Bison flaws enable arbitrary code execution
Two GNU Bison vulnerabilities let malicious grammar files execute arbitrary programs or overwrite files during HTML report generation.
CERT Polska coordinated disclosure of two vulnerabilities in GNU Bison, a widely used parser generator. CVE-2026-56389 stems from improper handling of the %define tool.xsltproc grammar directive, which is passed unsanitized to execvp() during bison --html execution, allowing an attacker-supplied grammar file to execute an arbitrary program with the privileges of the Bison process. CVE-2026-56390 involves grammar directives %output and %header that permit specifying arbitrary output file paths, which can override caller-supplied options and lead to overwriting existing files accessible to the Bison process.
Both issues were reported by researchers Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team and have been patched in upstream commits. Version 3.8.2 was confirmed vulnerable; maintainers did not specify a full affected version range, so earlier versions may also be impacted. Exploitation requires a victim to process an attacker-controlled grammar file with Bison, making this primarily a risk for build systems, CI pipelines, or tools that automatically process untrusted grammar files.
No evidence of active exploitation was reported. This is a supply-chain-adjacent risk relevant to software development and build tooling rather than a broad enterprise threat, and organizations using GNU Bison in automated build or documentation-generation pipelines should apply the fixes.
Mentioned in this report
Detection guidance
Bison Spawning Unexpected Child Process During HTML Generation
Detects bison --html invoking an arbitrary child process other than the expected xsltproc helper, consistent with exploitation of the unsanitized %define tool.xsltproc grammar directive (CVE-2026-56389) leading to arbitrary program execution via execvp(). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bison Spawning Unexpected Child Process During HTML Generation
description: Detects the GNU Bison parser generator (invoked with --html) spawning
a child process that is not the expected xsltproc helper. This generalises on the
parent/child relationship exploited by CVE-2026-56389, where a malicious grammar
file sets %define tool.xsltproc to an attacker-controlled program passed unsanitized
to execvp().
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /bison
ParentCommandLine|contains: --html
filter_expected_child:
Image|endswith: /xsltproc
condition: selection and not filter_expected_child
falsepositives:
- Custom build environments where bison --html is configured to call an alternate,
intentionally substituted XSLT processor
- Wrapper scripts that shim xsltproc via a symlink or renamed binary not caught by
the filter
level: high
id: e5d89b3f-2397-5ccf-b28d-7deb2c593436
status: experimental
author: Vorant
Bison Invoked with Output Path Traversal in Grammar-Controlled Arguments
Detects bison being run with --output/--header (or -o/-H) arguments that contain path traversal or absolute system paths, consistent with CVE-2026-56390 where a malicious grammar file overrides caller-supplied output paths to overwrite arbitrary accessible files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bison Invoked with Output Path Traversal in Grammar-Controlled Arguments
description: Detects bison command lines whose --output/--header/-o/-H arguments reference
parent directories or sensitive absolute paths, consistent with exploitation of
CVE-2026-56390 where a crafted grammar file's %output/%header directives override
the caller's intended output location to overwrite arbitrary files.
tags:
- attack.impact
- attack.t1565.001
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /bison
CommandLine|contains:
- --output
- --header
- '-o '
- '-H '
selection_traversal:
CommandLine|contains:
- ../
- /etc/
- /usr/
- /root/
condition: selection and selection_traversal
falsepositives:
- Legitimate build systems that pass absolute or relative paths outside the project
directory for output artefacts (e.g. shared include directories)
- Packaging scripts that intentionally regenerate headers into system include paths
during install
level: medium
id: 23df03f5-be4d-5659-bc53-9e65370c6d04
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-56389
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free