CVE-2026-6844: DoS in Binutils 2.31-2.40

Successful exploitation of CVE-2026-6844 allows a local attacker to crash the readelf utility, rendering it unresponsive. This can disrupt debugging and analysis workflows that rely on readelf. The vulnerability manifests in two ways: resource exhaustion, leading to an out-of-memory condition, and a null pointer dereference that triggers a segmentation fault. While the impact is localized to the readelf process, repeated exploitation could potentially impact system stability, especially on resource-constrained systems. The resource exhaustion aspect is particularly concerning as it could be leveraged to exhaust system memory, impacting other processes.

1. Reserved2026-04-22
2. Published2026-04-22
3. Modified2026-04-23
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-6844 is to upgrade to Binutils version 2.41 or later, which contains the fix. If an immediate upgrade is not feasible, consider restricting access to the readelf utility to trusted users only. While a direct WAF rule is unlikely to be effective, monitoring system resource usage (memory, CPU) for unusual spikes could indicate exploitation attempts. There are no specific Sigma or YARA rules available at this time, but monitoring ELF file parsing processes for unexpected behavior is recommended. After upgrading, confirm the fix by attempting to execute readelf with a known malicious ELF file (if available) and verifying that it does not crash.