CVE-2026-21996

LowCVSS 3.3

Published: 01/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer divide-by-zero in Pbuild_file_symtab(). The vulnerability stems from an integer division by zero error.

Risk Assessment

An unprivileged attacker can crash the dtrace process, potentially disrupting diagnostic and monitoring tools. This could be exploited in denial-of-service attacks.

Recommendation

Update the software containing dtrace to a patched version. Until updated, restrict the ability of unprivileged users to run dtrace.

Other vulnerabilities in dtrace

CVE-2026-35233Medium
An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to or instruments that process (via dtrace -p, pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without bounds checking. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of dtrace (DoS) or, depending on heap layout, a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.

Original NVD description (English source)

An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer Divide-by-Zero in Pbuild_file_symtab()

Vulnerability data from NVD (NIST) · CISA KEV · EPSS