PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6845 Red Hat CVE debrief

CVE-2026-6845 is a denial-of-service issue in GNU binutils' readelf utility. According to the CVE/NVD data, a local attacker can cause a crash or excessive resource consumption by getting a user to process a specially crafted ELF file. The reported impact is availability only, with no confidentiality or integrity impact listed.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
MEDIUM 5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-05-20
Advisory published
2026-04-22
Advisory updated
2026-05-20

Who should care

System administrators, distro maintainers, and developers who use binutils/readelf to inspect untrusted ELF files should care most. Red Hat environments are specifically listed in the NVD CPE data, including Enterprise Linux, OpenShift Container Platform, and hardened images.

Technical summary

The vulnerability is associated with CWE-476 (NULL pointer dereference) and is scored CVSS 3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H. NVD identifies GNU binutils as affected via the readelf utility, and the description says a specially crafted ELF file can drive DoS conditions through a crash or excessive resource usage.

Defensive priority

Medium. This is a local, user-interaction-dependent availability issue, but it can still disrupt workflows that inspect untrusted binaries or automate ELF analysis.

Recommended defensive actions

  • Apply vendor fixes from the Red Hat advisory for CVE-2026-6845 when available.
  • Avoid processing untrusted ELF files with readelf until patched.
  • If ELF inspection is automated, add input validation and isolate analysis jobs so a crash or resource spike does not affect other services.
  • Track the linked Red Hat Bugzilla issue for remediation status and package updates.
  • Review whether your systems use the affected GNU binutils package or any Red Hat products listed in the NVD CPE data.

Evidence notes

This debrief is based only on the supplied NVD record and its referenced vendor links. The NVD metadata lists GNU binutils and multiple Red Hat CPEs as vulnerable, gives the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H, and maps the weakness to CWE-476. The Red Hat advisory and Bugzilla entry are the only supplied vendor references.

Official resources

Publicly listed in the CVE/NVD record on 2026-04-22T09:16:27.373Z and last modified on 2026-05-20T13:58:17.100Z. Timing here reflects the CVE publication and modification dates supplied in the record.