p_lx_elf.cpp in UPX 3.94 mishandles ELF headers which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack().