GNU Bison vulnerabilities

4 CVEs affecting GNU Bison, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56390, published 2026-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-24240, published 2020-08-25. Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days. GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input,…
CVE-2020-14150, published 2020-06-15. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe…
CVE-2026-56389, published 2026-07-29. High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days. GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable…
CVE-2026-56390, published 2026-07-29. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override…