Medium severity5.5NVD Advisory· Published Oct 14, 2026

CVE-2026-110659

Description

ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA section has a dangling sh_link, causing find_hash_section() to dereference null and deny service.

Affected products

Serge1/Elfioreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=3.12

Patches

Vulnerability mechanics

References

github.com/serge1/ELFIO/blob/8ae6cec5d60495822ecd57d736f66149da9b1830/elfio/elfio_relocation.hppnvd
hackmd.io/@haind-pwn/elfio-relocation-get-entry-null-derefnvd
www.vulncheck.com/advisories/elfio-through-3.12-null-pointer-dereference-via-relocation-section-accessor-get-entrynvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000