CVE-2026-6845 Binutils: binutils: denial of service via crafted elf file
A local attacker can cause a denial of service by tricking a user into processing a crafted ELF file with readelf, leading to system unresponsiveness or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-6845?
CVE-2026-6845 is a medium-severity vulnerability in Gnu Binutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.
Weakness: CWE-476
Which versions are affected by CVE-2026-6845?
It affects 4 products.
Linux distribution packages (4)
binutils Red Hat:hummingbird:1 | All versions | 0:2.45.1-5.2.hum1 |
binutils-devel Red Hat:hummingbird:1 | All versions | 0:2.45.1-5.2.hum1 |
binutils-gold Red Hat:hummingbird:1 | All versions | 0:2.45.1-5.2.hum1 |
binutils-gprofng Red Hat:hummingbird:1 | All versions | 0:2.45.1-5.2.hum1 |
Products include Gnu Binutils, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform.
How do I fix CVE-2026-6845?
Apply the vendor's patch.
Is CVE-2026-6845 being exploited?
There is no known exploitation of CVE-2026-6845 in the wild and no public exploit code.
Other vulnerabilities in Gnu Binutils
Sources
Also known as AZL-85517, DEBIAN-CVE-2026-6845, ECHO-c7d8-12a5-dc19, GHSA-chmq-57c3-4p7v, MINI-rvhw-g2w9-g22m, OESA-2026-2152 and 2 more.