GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dumprelocations returns early due to parsing errors, the internal allrelocations array may remain partially uninitialized. Later, processgotsectioncontents() may attempt to free an invalid rsymbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in processdebuginfo(), an invalid debuginfop state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, bytegetlittleendian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.