GNU Bison flaws enable arbitrary code execution
Two GNU Bison vulnerabilities let malicious grammar files execute arbitrary programs or overwrite files during HTML report generation.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in GNU Bison, a widely used parser generator. CVE-2026-56389 stems from improper handling of the %define tool.xsltproc grammar directive, which is passed unsanitized to execvp() during bison --html execution, allowing an attacker-supplied grammar file to execute an arbitrary program with the privileges of the Bison process. CVE-2026-56390 involves grammar directives %output and %header that permit specifying arbitrary output file paths, which can override caller-supplied options and lead to overwriting existing files accessible to the Bison process.
Both issues were reported by researchers Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team and have been patched in upstream commits. Version 3.8.2 was confirmed vulnerable; maintainers did not specify a full affected version range, so earlier versions may also be impacted. Exploitation requires a victim to process an attacker-controlled grammar file with Bison, making this primarily a risk for build systems, CI pipelines, or tools that automatically process untrusted grammar files.
No evidence of active exploitation was reported. This is a supply-chain-adjacent risk relevant to software development and build tooling rather than a broad enterprise threat, and organizations using GNU Bison in automated build or documentation-generation pipelines should apply the fixes.
Mentioned in this report
Detection guidance
Bison Spawning Unexpected Child Process During HTML Generation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects bison --html invoking an arbitrary child process other than the expected xsltproc helper, consistent with exploitation of the unsanitized %define tool.xsltproc grammar directive (CVE-2026-56389) leading to arbitrary program execution via execvp(). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bison Spawning Unexpected Child Process During HTML Generation
description: Detects the GNU Bison parser generator (invoked with --html) spawning
a child process that is not the expected xsltproc helper. This generalises on the
parent/child relationship exploited by CVE-2026-56389, where a malicious grammar
file sets %define tool.xsltproc to an attacker-controlled program passed unsanitized
to execvp().
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /bison
ParentCommandLine|contains: --html
filter_expected_child:
Image|endswith: /xsltproc
condition: selection and not filter_expected_child
falsepositives:
- Custom build environments where bison --html is configured to call an alternate,
intentionally substituted XSLT processor
- Wrapper scripts that shim xsltproc via a symlink or renamed binary not caught by
the filter
level: high
id: e5d89b3f-2397-5ccf-b28d-7deb2c593436
status: experimental
author: Vorant
Bison Invoked with Output Path Traversal in Grammar-Controlled Arguments
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects bison being run with --output/--header (or -o/-H) arguments that contain path traversal or absolute system paths, consistent with CVE-2026-56390 where a malicious grammar file overrides caller-supplied output paths to overwrite arbitrary accessible files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bison Invoked with Output Path Traversal in Grammar-Controlled Arguments
description: Detects bison command lines whose --output/--header/-o/-H arguments reference
parent directories or sensitive absolute paths, consistent with exploitation of
CVE-2026-56390 where a crafted grammar file's %output/%header directives override
the caller's intended output location to overwrite arbitrary files.
tags:
- attack.impact
- attack.t1565.001
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /bison
CommandLine|contains:
- --output
- --header
- '-o '
- '-H '
selection_traversal:
CommandLine|contains:
- ../
- /etc/
- /usr/
- /root/
condition: selection and selection_traversal
falsepositives:
- Legitimate build systems that pass absolute or relative paths outside the project
directory for output artefacts (e.g. shared include directories)
- Packaging scripts that intentionally regenerate headers into system include paths
during install
level: medium
id: 23df03f5-be4d-5659-bc53-9e65370c6d04
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-56389
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs