CVE-2026-6844

A flaw was found in the readelf utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the readelf utility becoming unresponsive or crashing, leading to a denial of service.

Moderate: A denial of service vulnerability in readelf can be triggered by processing a crafted ELF file, leading to resource exhaustion or a null pointer dereference. This issue affects Red Hat Enterprise Linux 7, 8, 9, and 10, as well as other Red Hat products that include the binutils package. Exploitation requires a local attacker to entice a user to execute readelf on a malicious file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, users should avoid using the readelf utility on untrusted or suspicious ELF files. Processing a specially crafted ELF file with readelf can lead to a denial of service.