GNU Binutils

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, rather than for the report. Binutils sits in the Tier 1 'Toolchain security improvements' row, and the 2× memory-safety multiplier is reachable on this C codebase. Be realistic about the rung: Google states it puts little emphasis on fixing individual bugs, so an isolated BFD fuzz crash is priced as a one-liner and the $15,000 rung is for structural hardening. Patches must be one to twelve months old at submission, three a month per person, and sanctions and territory exclusions apply. CVE history 32 Last 12 months 290 Lifetime Memory safety 50 % Parsing/validation 30 % Denial of service 10 % Code execution 5 % Latest advisories Loading the feed Overview Binutils is on effectively every Linux build host and CI runner, invoked automatically by GCC, Clang toolchains, make and container image builds, and its ar format is the outer container of every Debian package. objdump and readelf are also the standard tools for inspecting untrusted binaries during malware triage, so a BFD parser bug points at the analyst opening a hostile artifact. It is one of the most productive fuzzing targets in open source: 290 lifetime CVEs, 32 in the last twelve months. The project pays nothing for a vulnerability report, and Google Patch Rewards pays only for a patch you land upstream and keep merged, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The sourceware security process takes any reproducible security defect in Binutils itself. The only boundary it draws is the project line: GDB, GCC and LLVM are separate projects even where they share a repository, so what follows is the whole Binutils tree The BFD library in full: the object-file parsers for ELF, PE/COFF, Mach-O and XCOFF together with the debug-info readers underneath them The binary-inspection tools as a set. objdump, readelf, nm, strings and addr2line parse attacker-supplied binaries, which is exactly what malware triage and CI artifact inspection do all day The ld linker and everything it consumes: hostile object files, linker scripts, archive members, where the input is chosen by whoever supplied the dependency ar and archive-member handling, directly relevant because a .deb is an ar archive and every Debian install unpacks one The object-transformation tools that CI pipelines apply to build outputs, including gprof, objcopy and strip, running unattended on artifacts a build may not fully control Out of scope GDB proper, which shares the repository but is a debugger rather than part of the build toolchain framing GCC and LLVM, which are separately listed and belong to the compiler framing rather than to Binutils Crashes found in a fuzzing harness with no merged upstream fix behind them, which earn nothing on the Google patch pathway Distribution packaging of Binutils rather than defects in the upstream sources One-line patches that fix non-exploitable crashes, including crashes that only amount to resource exhaustion, which the Patch Rewards rules say will not generally be rewarded Most-valued findings Memory corruption in a BFD parser that reaches control of execution rather than stopping at a crash. Memory safety is half the bug volume here, and a mere abort is the one thing this program has an oversupply of A defect in objdump, readelf or nm that turns inspecting a hostile binary into compromise of the analyst's machine, which inverts the trust model these tools are used under Anything in ar or archive-member handling that misbehaves on a crafted .deb, since that puts the bug on the package-installation path Linker-side flaws where a hostile object file or linker script influences the produced binary, because that quietly compromises the artifact every downstream user installs Structural hardening of a parser family rather than a single crash fix. That is what the top reward rung is actually for, and what the panel says it wants Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report through the sourceware security contact or Bugzilla, with the object file that triggers it; if it cannot be reproduced it is not eligible Show the bug in Binutils itself rather than in GDB, GCC or LLVM, which are separate projects even where they share a repository Give the maintainers room to ship a fix before you publish, and expect friction reaching the tracker: sourceware sits behind a proof-of-work bot wall If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway with its own rules On that pathway the panel explicitly de-emphasises individual bug fixes: a lone fuzz crash is priced as a one-liner, and the high rungs are for structural hardening. GNU copyright-assignment or DCO friction applies, patches must be one to twelve months old, and it is capped at three per person per month Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the Binutils maintainers through sourceware's SECURITY.txt process and Bugzilla. Patch Rewards imposes no confidentiality or embargo term of its own, so timing is upstream's call; Binutils triages a very high volume of fuzz-derived reports, so say clearly in the report why yours crosses from a crash into a security boundary. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability