CVE-2026-110659: ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry
ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocationsectionaccessor getentry() that allows attackers to crash applications via an unvalidated shlink index. Attackers can supply a crafted ELF file whose SHTREL or SHTRELA section has a dangling shlink, causing findhashsection() to dereference null and deny service.
Affected Software
Event History
Frequently Asked Questions
Which releases should be treated as affected?
ELFIO releases through 3.12 are affected.
What must an attacker provide to trigger the issue?
The attacker must cause an application using ELFIO to process a crafted ELF file containing an SHT_REL or SHT_RELA section with a dangling sh_link value. The attack vector is local and requires user interaction.
What is the expected security impact?
Successful exploitation crashes the affected application, resulting in denial of service. The provided assessment indicates no confidentiality or integrity impact.