What’s Vulnerable › Vulnerabilities

CVE-2026-6844: Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-400

Description

A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service.

Affected products

• GNU Binutils: all versions
• Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0
• RedHat Hardened Images: all versions
• Red Hat OpenShift Container Platform 4.18: 4.0

References

• https://access.redhat.com/security/cve/CVE-2026-6844
• https://bugzilla.redhat.com/show_bug.cgi?id=2460016

Get alerted when CVE-2026-6844 or the next vulnerability affects your stack