ELFIO, a C++ library for reading and writing ELF files, contains a NULL pointer dereference in the relocation_section_accessor::get_entry() member. The flaw arises when the relocation section’s sh_link field references a non‑existent hash section, causing find_hash_section() to dereference a NULL pointer. This results in an application crash but does not provide direct code execution or data disclosure. The weakness is identified as CWE-476.

The affected vendor is serge1, with the product ELFIO library. Versions through 3.12 are impacted; any downstream application or tool that incorporates ELFIO 3.12 or earlier and processes untrusted ELF files is potentially vulnerable.

The CVSS score of 6.8 indicates moderate severity and reflects a denial‑of‑service scenario. EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted ELF file controlled by the attacker that contains a dangling sh_link in the SHT_REL or SHT_RELA section. If the application loads this file using the vulnerable library, the crash will occur. No remote code execution is implied by the current description. The exploit requires only the ability to supply a malicious ELF file to the victim, suggesting a relatively simple local or supply‑chain attack.