Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files

Successful exploitation of CVE-2026-6844 allows a local attacker to crash the readelf utility, resulting in a denial of service. The vulnerability manifests in two ways: resource exhaustion, which can lead to an out-of-memory condition, and a null pointer dereference, which causes a segmentation fault. The attacker needs only to provide a malicious ELF file to trigger these conditions. This disruption can impact system administrators and developers who rely on readelf for debugging and analysis, potentially hindering their ability to inspect and manipulate binaries.

Systems administrators and developers who rely on the readelf utility for debugging and analysis are at risk. Environments with limited access controls, where untrusted users can execute commands as root or privileged users, are particularly vulnerable. Developers working with custom ELF files or embedded systems that utilize Binutils should also be aware of this vulnerability.

• linux / server:

journalctl -g "readelf" -p err

• linux / server:

ps aux | grep readelf

• linux / server:

 auditd -l | grep readelf

1. 2026-04-22Disclosure

   disclosure

1. Reserviert2026-04-22
2. Veröffentlicht2026-04-22
3. Geändert2026-04-23
4. EPSS aktualisiert2026-04-29

The primary mitigation for CVE-2026-6844 is to upgrade Binutils to version 2.41 or later. If upgrading is not immediately feasible, restrict access to the readelf utility to trusted users only. Consider implementing input validation on ELF files processed by readelf to detect and reject potentially malicious files. While a WAF is not applicable here, restricting file uploads and parsing within the system can reduce the attack surface. After upgrading, confirm functionality by attempting to parse a variety of ELF files, including those known to be complex or potentially problematic.