binutils readelf CVE-2026-6844

Exploitation requires the following specific conditions: (1) local system access to invoke the readelf utility, (2) ability to provide a specially crafted ELF file as input to readelf (either by placing it in a location readelf accesses or by directly supplying it as an argument), and (3) user interaction - a user or automated process must execute readelf against the malicious file. The vulnerability does NOT require elevated privileges (PR:N) and does NOT require prior authentication beyond local system access. The attack is limited by requirement for user interaction (UI:R), meaning the attacker cannot remotely trigger readelf to process a malicious file without social engineering or placement in a location where automated tools will process it. The vulnerability is NOT exploitable via network attack, remote command execution, or any mechanism that does not require local file system access and readelf invocation.

The CVSS 5.5 score reflects low to medium severity: local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), but user interaction required (UI:R) to open the malicious file, with impact limited to availability (A:H). The CVSS vector indicates this is NOT a remote vulnerability and requires a user to actively open a crafted file. Real-world risk depends on threat model: in environments where readelf is regularly used by developers, system administrators, or automated build systems to parse untrusted ELF binaries (e.g., malware analysis, reverse engineering, package verification), the risk is elevated. However, in production systems where readelf is rarely invoked interactively, risk is minimal. The requirement for user interaction (UI:R) significantly reduces the attack surface compared to an unauthenticated remote exploit. No EPSS score, KEV status, or public POC availability is documented in the provided intelligence, suggesting this is a lower-priority finding with limited weaponization potential to date. Defenders should prioritize based on whether readelf is exposed to untrusted input in their environment.

A security researcher conducting malware analysis downloads a suspicious binary from the internet and runs readelf locally to inspect its ELF headers and sections. The binary is actually a malicious file crafted with malformed ELF structures. When readelf parses the file, the resource exhaustion flaw causes the utility to allocate excessive memory, consuming all available RAM and causing system slowdown or crash. Alternatively, if the null pointer dereference is triggered first, readelf immediately segfaults, terminating abruptly without returning results.