CVE-2020-35495: There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

CVE-2020-35495 is a vulnerability in There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34., rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 1.21% probability of exploitation activity in the next 30 days, higher than 69% of all scored vulnerabilities. Microsoft released the fix on 6 January 2021, outside Patch Tuesday. It affects 1 product in 1 product family (Other).

Key facts

CVE ID: CVE-2020-35495
Severity: Medium CVSS 5.5
Microsoft severity: Moderate
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-476
EPSS: 1.21% (percentile 69%)
CISA KEV: Not listed
Released: 6 January 2021
Last updated: 6 January 2021
Patch Tuesday: January 2021 Patch Tuesday
Product families: Other

CVSS score and vector

Microsoft scores CVE-2020-35495 at 5.5 (temporal 5.5) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Metric	Value
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (1)

Other

Product	Security update	Type	Fixed build	Restart
19139-16820	CBL-Mariner Releases	Security Update	2.32-5	No

NIST NVD data

NVD status: Modified
NVD CVSS: 5.5 (MEDIUM)
NVD weakness: CWE-476
Published to NVD: 4 January 2021
NVD last modified: 8 October 2026

Affected configurations (CPE)

Product	Vulnerable versions
binutils	before 2.34
fedora 32	all listed versions
cloud backup	all listed versions
ontap select deploy administration utility	all listed versions
solidfire\, enterprise sds \& hci storage node	all listed versions
solidfire \& hci management node	all listed versions
brocade fabric operating system firmware	all listed versions
hci compute node firmware	all listed versions

References

https://bugzilla.redhat.com/show_bug.cgi?id=1911441 (Exploit, Issue Tracking, Patch, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/
https://security.gentoo.org/glsa/202107-24 (Third Party Advisory)
https://security.netapp.com/advisory/ntap-20210212-0007/ (Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1911441 (Exploit, Issue Tracking, Patch, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/
https://security.gentoo.org/glsa/202107-24 (Third Party Advisory)
https://security.netapp.com/advisory/ntap-20210212-0007/ (Third Party Advisory)

Revision history

Version	Date	Description
1.0	6 January 2021	Information published.