Quick answers
- Is CVE-2026-3441 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3441 being exploited in the wild.
- How severe is CVE-2026-3441?
- Medium severity, with a CVSS score of 6.1, published 16 March 2026.
- Which products and versions are affected?
- Gnu Binutils 2.45.1-5.1.hum1.
- Is there a fix for CVE-2026-3441?
- A patch was published on 2026-06-30: Red Hat released security update RHSA-2026:33527 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-3441 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-3441?
- Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow, specifically an out-of-bounds read, exists in the GNU Binutils BFD linker. The vulnerability is located in the 'xcoff_link_add_symbols' function within 'bfd/xcofflink.c'. It is caused by an improper validation check of the 'x_scnlen' value, which results in an out-of-bounds access on the 'csects' array. An attacker can exploit this by convincing a user to process a specially crafted XCOFF object file using the 'ld' linker. Successful exploitation can lead to the disclosure of sensitive memory contents or an application-level denial of service (crash). Red Hat has released updates for affected Hardened Images to address this and related vulnerabilities.
Affected products
- GNU Binutils 2.45.1-5.1.hum1
- Red Hat Enterprise Linux 6 affected
- Red Hat Hardened Images affected
Timeline
- 2026-03-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-16: advisory: NVD publication date
- 2026-06-30: patched: Red Hat released security update RHSA-2026:33527