binutils readelf EUVD-2026-24712

The vulnerability requires a local user (non-root, PR:L) to execute the readelf command directly against a specially crafted ELF file. The file must contain specific malformed sections or headers that trigger the null pointer dereference in readelf's parsing logic. User interaction is mandatory (UI:R): an attacker cannot exploit this remotely or force execution - the user must intentionally or be socially engineered into running readelf on the malicious file. The vulnerability does not affect systems where readelf is not installed or where file access controls prevent unprivileged users from creating or modifying files in directories where readelf might be executed. Exploitation is limited to the readelf process scope (S:U); it does not escape to affect other processes or the wider system.

This vulnerability presents moderate real-world risk with significant limiting factors. The CVSS score of 5.0 reflects the constraints: local access required (AV:L), low complexity (AC:L), low privileges (PR:L), and user interaction needed (UI:R) to trigger the flaw. The EPSS score and KEV status are not provided, limiting confidence in widespread exploitation likelihood. The impact is availability-only (denial of service via resource exhaustion or crash), with no confidentiality or integrity compromise. The null pointer dereference is a common class of vulnerability but typically requires specific malformed input. This is not a remote code execution risk and affects only users or administrators who directly invoke readelf on untrusted files - a relatively uncommon scenario in production systems where readelf is typically used on trusted binaries during development or troubleshooting. The requirement for user interaction (UI:R) means the attack cannot be fully automated; an attacker must social engineer or trick a user into processing the file.

An attacker crafts a malicious ELF file and emails it to a developer or system administrator, claiming it is a binary to be analyzed. When the recipient runs readelf on the file to inspect its structure, the null pointer dereference triggers, causing readelf to crash or enter an infinite loop that consumes CPU and memory resources. If readelf is invoked by an automated script or CI/CD pipeline, the crash could disrupt the build process.