CVE-2026-35233

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35233", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-04-01T20:03:40.833Z", "datePublished": "2026-05-01T17:53:17.209Z", "dateUpdated": "2026-05-01T18:16:32.848Z"}, "containers": {"cna": {"affected": [{"product": "Oracle Linux", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "8"}, {"status": "affected", "version": "9"}, {"status": "affected", "version": "10"}]}], "descriptions": [{"lang": "en", "value": "An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.", "lang": "en", "type": "text"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-05-01T17:53:17.209Z"}, "references": [{"name": "Oracle Advisory", "tags": ["vendor-advisory"], "url": "https://linux.oracle.com/cve/CVE-2026-35233.html"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-01T18:16:16.000117Z", "id": "CVE-2026-35233", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T18:16:32.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35233", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T18:16:16.000117Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T18:16:28.686Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Linux", "versions": [{"status": "affected", "version": "8"}, {"status": "affected", "version": "9"}, {"status": "affected", "version": "10"}]}], "references": [{"url": "https://linux.oracle.com/cve/CVE-2026-35233.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context."}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-05-01T17:53:17.209Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35233", "state": "PUBLISHED", "dateUpdated": "2026-05-01T18:16:32.848Z", "dateReserved": "2026-04-01T20:03:40.833Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2026-05-01T17:53:17.209Z", "assignerShortName": "oracle"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Oracle Linux", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "8"}, {"status": "affected", "version": "9"}, {"status": "affected", "version": "10"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:*", "matchCriteriaId": "CA9021D6-6027-42E9-A12D-7EA32C5C63F1", "vulnerable": true}, {"criteria": "cpe:2.3:o:oracle:linux:9:0:*:*:*:*:*:*", "matchCriteriaId": "C848CA1D-A42D-4AF1-9D95-E6268F9C1880", "vulnerable": true}, {"criteria": "cpe:2.3:o:oracle:linux:10:0:*:*:*:*:*:*", "matchCriteriaId": "1F606DC6-31B5-4102-B174-D565662C4829", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context."}, {"lang": "es", "value": "Un atacante sin privilegios puede crear un proceso en espacio de usuario con un binario ELF malicioso que contiene un campo sh_link fuera de rango. Cuando dtrace a nivel de root se adjunta a -- o instrumenta -- ese proceso (a trav\u00e9s de dtrace -p , sondas pid o USDT), el analizador ELF lee memoria del heap m\u00e1s all\u00e1 del array de cach\u00e9 de secciones asignado sin ninguna comprobaci\u00f3n de l\u00edmites. Esto resulta en una lectura de heap no inicializada/fuera de l\u00edmites que puede causar un fallo por desreferencia de puntero NULL del proceso dtrace (DoS), o -- dependiendo de la disposici\u00f3n del heap -- una lectura y posterior uso de un puntero basura controlado por asignaciones adyacentes, proporcionando un punto de apoyo para una explotaci\u00f3n posterior en un contexto privilegiado."}], "id": "CVE-2026-35233", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35233", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-01T18:16:16.000117Z", "version": "2.0.3"}}]}, "published": "2026-05-01T18:16:14.647", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://linux.oracle.com/cve/CVE-2026-35233.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle Linux", "source": "cna", "vendor": "Oracle Corporation"}, "product": "oracle_linux", "vendor": "oracle_corporation"}], "created": "2026-05-01T22:45:25.840640+00:00", "title": "Out\u2011of\u2011Bounds ELF Parsing in dtrace Causes Crash or Privilege Escalation", "updated": "2026-05-02T07:00:06.942861+00:00", "vendors": ["oracle_corporation", "oracle_corporation$PRODUCT$oracle_linux"]}