ELFIO CVE-2026-110659

Exploitation requires that an application using ELFIO parse an attacker-controlled ELF file and invoke relocation_section_accessor::get_entry() on a SHT_REL or SHT_RELA section whose sh_link field references a missing/dangling section index, so find_hash_section() returns null. This is not remote-unauthenticated against a service: the CVSS vector is AV:L with UI:P (Passive), meaning the attacker must get the ELF file processed locally by the victim application - the realistic trigger is tooling that ingests untrusted binaries. Limiting factors: impact is availability-only (process crash/DoS), there is no memory corruption, code execution, or data exposure; exploitation depends on the host application actually calling the vulnerable relocation accessor on untrusted input, so software that only handles trusted ELF files is not realistically at risk.

This is a denial-of-service-only NULL pointer dereference (CWE-476) in the ELFIO C++ ELF-parsing library, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and correctly reflects a local, passive-user-interaction attack with availability-only impact - no confidentiality or integrity loss and no code execution. Publicly available exploit code exists (a hackmd write-up linked as an exploit reference) and the issue was reported by VulnCheck, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active exploitation; the POC demonstrates a crash, not weaponized RCE. The practical risk is therefore moderate and bounded: real priority only for software that parses untrusted/attacker-supplied ELF files using ELFIO (e.g. binary-analysis tooling, malware scanners, reverse-engineering utilities), where a crash is an availability concern, and low priority elsewhere. This is a genuine but limited issue - a high-visibility advisory on a DoS bug, not a high-CVSS-but-overhyped critical flaw.

An attacker crafts a malformed ELF file whose SHT_REL or SHT_RELA section carries a dangling sh_link index pointing to a non-existent symbol-table section. A victim application built on ELFIO (such as a binary-analysis or scanning tool) opens the file and calls relocation_section_accessor::get_entry(), whereupon find_hash_section() returns null and the dereference crashes the process. Public proof-of-concept exploit material is already available in the linked advisory/write-up.