CVE-2020-24240
GNU Bison 3.7 has a use after free (UAF) vulnerability. A local attacker may execute bison with...
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
CVE-2020-24240- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
CVE-2020-24240- Updated
- 2026-11-02
EUVDEUVD-2020-16975 No score
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
EUVD-2020-16975- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5xv5-wxfg-845r No score
GNU Bison 3.7 has a use after free (UAF) vulnerability. A local attacker may execute bison with...
GNU Bison 3.7 has a use after free (UAF) vulnerability. A local attacker may execute bison with crafted input file containing a NULL byte, which could triggers UAF and thus cause system crash.
- Record
GHSA-5xv5-wxfg-845r- Updated
- 2026-11-02
OSVALPINE-CVE-2020-24240
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
ALPINE-CVE-2020-24240- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2020-24240
CVE-2020-24240 does not affect BellSoft software
- Record
BELL-CVE-2020-24240- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
CVE-2020-24240- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-24240
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
DEBIAN-CVE-2020-24240- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-1767
bison security update
Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR (GLR) parser employing LALR(1) parser tables. As an experimental feature, Bison can also generate IELR(1) or canonical LR(1) parser tables. Once you are proficient with Bison, you can use it to develop a wide range of language parsers, from those used in simple desk calculators to complex programming languages.
Security Fix(es):
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.(CVE-2020-24240)
- Record
OESA-2022-1767- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-24240
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
- Record
UBUNTU-CVE-2020-24240- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bisonAlpine:v3.13 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.14 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.15 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.16 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.17 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.18 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.19 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.20 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.21 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.22 |
before 3.7.2-r0 | 3.7.2-r0 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bisonAlpine:v3.23 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonAlpine:v3.24 |
before 3.7.2-r0 | 3.7.2-r0 |
bisonDebian:12 |
before 2:3.7.2+dfsg-1 | 2:3.7.2+dfsg-1 |
bisonDebian:13 |
before 2:3.7.2+dfsg-1 | 2:3.7.2+dfsg-1 |
bisonDebian:14 |
before 2:3.7.2+dfsg-1 | 2:3.7.2+dfsg-1 |
bisonopenEuler:20.03-LTS-SP1 |
before 3.6.4-2.oe1 | 3.6.4-2.oe1 |
bisonopenEuler:20.03-LTS-SP3 |
before 3.6.4-3.oe1 | 3.6.4-3.oe1 |
bisonUbuntu:16.04:LTS |
All versions, plus listed versions 2:3.0.2.dfsg-22:3.0.4.dfsg-1 |
None known |
bisonUbuntu:18.04:LTS |
All versions, plus listed versions 2:3.0.4.dfsg-1build1 |
None known |
bisonUbuntu:20.04:LTS |
All versions, plus listed versions 2:3.4.1+dfsg-42:3.4.2+dfsg-12:3.5.1+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24240 is a medium vulnerability (CVSS 5.5) in Gnu Bison, published August 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in bison 3.7.2-r0.