CVE-2026-35233 is a vulnerability where an unprivileged attacker can create a malicious ELF binary with an out-of-range sh_link field. When a root-level dtrace process attaches to or instruments this malicious process, the ELF parser performs an out-of-bounds heap read without bounds checking. This can cause a NULL pointer dereference crash of the dtrace process (denial of service) or potentially allow reading of garbage pointers, which may lead to further exploitation in a privileged context.