CVE-2026-6844

CVE-2026-6844 is a flaw in the readelf utility within the binutils package that introduces two distinct denial of service vulnerabilities. An attacker can exploit these issues by supplying a specially crafted ELF file, triggering either resource exhaustion leading to out-of-memory conditions or a null pointer dereference that causes segmentation faults. Both conditions render the readelf utility unresponsive or cause it to crash. The vulnerability carries a CVSS base score of 5.5 (Medium), with a local attack vector requiring no privileges but user interaction to trigger. The impact is limited to availability degradation with no confidentiality or integrity implications. The attack requires low complexity and affects the local system only, making it less critical than remote exploits but still operationally relevant for environments where readelf is exposed to untrusted input. There is currently no evidence of active exploitation in the wild, with no public exploit code available and the vulnerability absent from CISA's Known Exploited Vulnerabilities catalog. The EPSS probability of exploitation is negligible at 0.00013, and the FAUCET risk score of 41.0 indicates moderate overall concern. Organizations should prioritize patching based on their use of binutils in processing potentially untrusted ELF files rather than treating this as an immediate threat.