This vulnerability (CVE-2026-6845) exists in the readelf utility within binutils, specifically in Red Hat Hardened Images. A local attacker can exploit this by tricking a user into processing a maliciously crafted ELF file, resulting in a denial of service through resource exhaustion or a null pointer dereference causing a crash. The issue is tracked under CWE-476 (NULL Pointer Dereference). Red Hat has published an advisory (RHSA-2026:34924) describing the flaw and the affected packages (binutils-2.45.1-5.2.hum1 for aarch64 and x86_64). The vulnerability impacts availability but does not affect confidentiality or integrity. No known exploits are reported in the wild. The advisory does not confirm a patch release yet.

The vulnerability allows a local attacker to cause a denial of service by causing the readelf utility to crash or consume excessive resources when processing a crafted ELF file. This results in system unresponsiveness or program termination. There is no impact on confidentiality or integrity. No remote exploitation vector is indicated; user interaction is required to process the malicious file.

Users should avoid processing untrusted or suspicious ELF files with the readelf utility. There is no configuration or operational control to prevent this vulnerability without impacting readelf functionality. Monitor Red Hat advisories for updates on patches or fixes. Currently, no official fix has been released.