CVE-2026-35233
Heap Out-of-Bounds Read in DTrace
Publication date: 2026-05-01
Last updated on: 2026-05-05
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | linux | 8 |
| oracle | linux | 10 |
| oracle | linux | 9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the errata fixes released by Oracle for the dtrace package in Oracle Linux versions 8, 9, and 10.
These updates address the issue by correcting the ELF parser's handling of the sh_link field to prevent out-of-bounds heap reads.
Ensure your system is updated with the latest patches dated April 30, 2026, or later.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a malicious ELF binary crafted with an out-of-range sh_link field that triggers issues when dtrace attaches to the process. Detection would involve identifying such malicious ELF binaries or monitoring dtrace usage for crashes or unusual behavior.
There are no specific detection commands or tools provided in the available resources or CVE description.
Can you explain this vulnerability to me?
This vulnerability involves an unprivileged attacker creating a malicious ELF binary with an out-of-range sh_link field. When a root-level dtrace process attaches to or instruments this malicious process, the ELF parser reads memory beyond the allocated section cache array without proper bounds checking. This causes an out-of-bounds heap read which can lead to a NULL pointer dereference crash (denial of service) or potentially allow the attacker to exploit the dtrace process further by using a garbage pointer controlled by adjacent memory allocations.
How can this vulnerability impact me? :
The vulnerability can impact you by causing the dtrace process running with root privileges to crash, resulting in a denial of service (DoS). Additionally, depending on the heap memory layout, it may allow an attacker to gain a foothold for further exploitation in a privileged context, potentially compromising system security.