Skip to content
OpenAdvisories
Medium USN-8777-1 1 CVE

bison vulnerability

Published Sep 17, 2026 · Updated Sep 18, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GNU Bison incorrectly handled grammar-defined
configuration variables when generating HTML reports. An attacker could
possibly use this issue to execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS bison 2:3.8.2+dfsg-1ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS bison 2:3.8.2+dfsg-1ubuntu0.24.04.1
Ubuntu · 26.04 LTS 26.04:LTS bison 2:3.8.2+dfsg-1ubuntu0.26.04.1

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-56389

    Arbitrary Command Execution in GNU Bison

    GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define to…

    GNU Bison bison bison Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-56389