CVE-2026-6845: Binutils: binutils: denial of service via crafted elf file
A flaw was found in binutils, specifically within the readelf utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.
Other sources
Two DoS vulnerabilities in readelf 2.46: 1. Resource exhaustion: 1KB crafted ELF triggers 6.3TB allocation (357M relocation entries), OOM kill 2. Null pointer deref: malformed shentsize/shoff causes SIGSEGV
Found via AFL++ QEMU-mode fuzzing. PoC files provided. Not disclosed publicly.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6845?
CVE-2026-6845 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-6845?
To fix CVE-2026-6845, update the binutils package to the latest version available from your vendor.
Who is affected by CVE-2026-6845?
CVE-2026-6845 affects users of the GNU readelf utility in binutils version 2.46.
What type of attack is associated with CVE-2026-6845?
CVE-2026-6845 allows for a Denial of Service (DoS) attack through crafted ELF files.
Can CVE-2026-6845 be exploited remotely?
CVE-2026-6845 requires local access to exploit, as it involves processing a crafted file.