CVE-2026-35233
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to or instruments that process (via dtrace -p, pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without bounds checking. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of dtrace (DoS) or, depending on heap layout, a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.
Risk Assessment
An attacker could crash the dtrace process (DoS) or potentially gain a foothold for further exploitation in a privileged context. The risk applies to systems where administrators use dtrace to instrument untrusted processes.
Recommendation
Update dtrace to a version containing the bounds-check fix in the ELF parser. Avoid instrumenting untrusted processes with root-level dtrace.
Other vulnerabilities in dtrace
Original NVD description (English source)
An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS