CVE-2026-6845

What it actually does

CVE-2026-6845 is a local denial-of-service vulnerability in GNU binutils, specifically the readelf utility. When readelf parses a specially crafted ELF file, it can crash or consume excessive CPU or memory, causing the readelf process — and potentially the host or container where it runs — to become unresponsive. The vulnerability does not provide code execution, privilege escalation, or data disclosure based on the available description; its primary impact is availability loss during ELF analysis.

Why it matters to the business

Organizations that use binutils as part of software build pipelines, malware analysis workflows, package inspection, container image scanning, CI/CD validation, debugging, or system administration may experience failed jobs, stalled analysis, degraded developer productivity, or resource exhaustion on shared systems if malicious or malformed ELF files are processed. Because exploitation requires local access and user interaction, and current EPSS is very low with no known KEV listing or public exploit maturity, broad internet-scale exploitation is unlikely; however, environments that routinely process untrusted binaries are more exposed.

How an attack unfolds

An attacker prepares a malformed ELF file designed to trigger pathological behavior in readelf. The attacker then gets a user, automation job, scanner, build system, or analysis workflow to run readelf against that file. Once processed, readelf may crash or consume excessive system resources. In interactive use, this may interrupt the analyst or administrator; in automated workflows, it may block CI/CD jobs, exhaust container resources, or degrade shared build and inspection infrastructure. The attacker needs local execution context or a path to influence files that a victim process will inspect, and exploitation depends on the vulnerable readelf binary being invoked on the crafted ELF file.

How to fix it

Upgrade GNU binutils packages to a vendor-fixed version as soon as updates are available for the affected operating system or container base image. For Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, Red Hat hardened images, and other downstream distributions, apply the relevant vendor security errata and rebuild dependent container images so the fixed readelf binary is included. If a fixed version is not yet available, reduce exposure by avoiding use of readelf on untrusted ELF files, running binary-inspection tools inside resource-constrained sandboxes or disposable containers, applying CPU and memory limits to CI/CD and analysis jobs, and isolating workflows that process third-party binaries.

How to confirm the fix worked

Confirm remediation by checking the installed binutils package version against the operating system or image vendor advisory once fixed builds are published. Verify that container images, build runners, and analysis environments have been rebuilt from patched base images rather than only patching long-lived hosts. Test that automation invoking readelf runs with resource limits and fails safely when processing malformed files. Review package inventories and software composition reports for vulnerable binutils versions across hosts and images.

Typical attack path

1. Attacker creates or obtains a specially crafted ELF file that triggers the vulnerable parsing behavior in readelf.
2. Attacker places the file where a user, scanner, build pipeline, package inspection tool, or analysis workflow is likely to process it.
3. A user or automated job invokes readelf on the crafted ELF file.
4. The vulnerable readelf process crashes or enters excessive resource consumption.
5. The affected workstation, container, CI runner, or shared analysis host experiences job failure, slowdown, or unresponsiveness until the process is killed or resources are recovered.

How to detect it

Look for evidence that readelf was invoked on suspicious or recently introduced ELF files followed by crashes, abnormal CPU or memory usage, job timeouts, container restarts, or host instability. Useful log sources include shell history, auditd process execution logs, EDR process telemetry, CI/CD job logs, container runtime logs, systemd journal entries, kernel OOM-killer messages, core dump records, and crash reporting systems. Investigate sequences where readelf processes run for unusually long periods, are killed by timeout controls, terminate with segmentation faults or aborts, or coincide with high memory consumption. In build and analysis environments, correlate failed jobs with uploaded binaries or artifacts introduced shortly before the failure. Because no specific public exploit artifact is provided, detection should focus on behavioral indicators around readelf crashes and resource exhaustion rather than static signatures.

• process_name=readelf
• command_line contains "readelf"
• "readelf: Segmentation fault"
• "Segmentation fault (core dumped)"
• "readelf" "core dumped"
• "Out of memory: Killed process" "readelf"
• "Killed process" "readelf"
• "oom-killer" "readelf"
• "timeout" "readelf"
• "readelf" "Aborted"
• "readelf" "crashed"
• "readelf" "killed"

What your security team should do

• Prioritize patching systems and container images that process untrusted ELF files, including CI/CD runners, package scanners, malware analysis environments, developer workstations, and build infrastructure.
• Track vendor advisories for GNU binutils and downstream Red Hat products, and apply fixed packages when released.
• Add CPU, memory, timeout, and container isolation controls around readelf and other binary-parsing utilities used in automated workflows.
• Restrict who can submit binaries to automated inspection pipelines and quarantine externally supplied ELF files before analysis.
• Monitor for repeated readelf crashes, high resource consumption, or job timeouts associated with ELF processing.
• Rebuild and redeploy affected container images after base image updates to ensure the patched utility is actually present in runtime environments.