elfutils v0.189 exists to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.