Vulnerability · Published Apr 22, 2026 · Assigned by redhat
CVE-2026-6845Binutils: binutils: denial of service via crafted elf file
Medium 5.0
In plain English
A medium-severity null pointer dereference in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | binutils | no fix listed | DEBIAN-CVE-2026-6845 |
| Debian:13 | binutils | no fix listed | DEBIAN-CVE-2026-6845 |
| Debian:14 | binutils | no fix listed | DEBIAN-CVE-2026-6845 |
| Ubuntu:22.04:LTS | binutils | no fix listed | UBUNTU-CVE-2026-6845 |
| Ubuntu:24.04:LTS | binutils | no fix listed | UBUNTU-CVE-2026-6845 |
| Ubuntu:25.10 | binutils | no fix listed | UBUNTU-CVE-2026-6845 |
| Ubuntu:26.04:LTS | binutils | no fix listed | UBUNTU-CVE-2026-6845 |
| Ubuntu:26.10 | binutils | no fix listed | UBUNTU-CVE-2026-6845 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
References
- RHSA-2026:34924 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:39022 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-6845 vdb-entry, x_refsource_REDHAT
- RHBZ#2460012 issue-tracking, x_refsource_REDHAT