# CVE-2026-3441: GNU Binutils out-of-bounds read in BFD linker

Source: https://junglewise.ai/threats/cve-2026-3441-gnu-binutils-out-of-bounds-read-in-bfd-linker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3441 · Severity: medium · CVSS 6.1 · Published 2026-03-16

GNU Binutils is a collection of binary tools used by developers to create and manage software programs. A security flaw in its linker component could allow an attacker to access sensitive information or cause the software to crash. To exploit this, an attacker would need to trick a user into processing a specially crafted malicious file, potentially leading to data exposure or a disruption of development workflows.

Technologies: [Gnu Binutils](https://junglewise.ai/threats/technologies/binutils). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-3441 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3441 being exploited in the wild.

**How severe is CVE-2026-3441?** Medium severity, with a CVSS score of 6.1, published 16 March 2026.

**Which products and versions are affected?** Gnu Binutils 2.45.1-5.1.hum1.

**Is there a fix for CVE-2026-3441?** A patch was published on 2026-06-30: Red Hat released security update RHSA-2026:33527 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3441 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-3441?** Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow, specifically an out-of-bounds read, exists in the GNU Binutils BFD linker. The vulnerability is located in the 'xcoff_link_add_symbols' function within 'bfd/xcofflink.c'. It is caused by an improper validation check of the 'x_scnlen' value, which results in an out-of-bounds access on the 'csects' array. An attacker can exploit this by convincing a user to process a specially crafted XCOFF object file using the 'ld' linker. Successful exploitation can lead to the disclosure of sensitive memory contents or an application-level denial of service (crash). Red Hat has released updates for affected Hardened Images to address this and related vulnerabilities.

## Affected products

- GNU Binutils 2.45.1-5.1.hum1
- Red Hat Enterprise Linux 6 affected
- Red Hat Hardened Images affected

## Timeline

- 2026-03-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-16: advisory: NVD publication date
- 2026-06-30: patched: Red Hat released security update RHSA-2026:33527

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:33527](https://access.redhat.com/errata/RHSA-2026:33527)
- [https://access.redhat.com/security/cve/CVE-2026-3441](https://access.redhat.com/security/cve/CVE-2026-3441)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2443826](https://bugzilla.redhat.com/show_bug.cgi?id=2443826)

## Related threats

- [GNU Binutils null pointer dereference in dynamic relocation allocation](https://junglewise.ai/threats/cve-2026-91782-gnu-binutils-null-pointer-dereference-in-dynamic-relocation)
- [GNU Binutils null pointer dereference in ELF section handler](https://junglewise.ai/threats/cve-2026-91781-gnu-binutils-null-pointer-dereference-in-elf-section-handler)
- [GNU Binutils null pointer dereference in ELF linker](https://junglewise.ai/threats/cve-2026-91780-gnu-binutils-null-pointer-dereference-in-elf-linker)
- [GNU Binutils null pointer dereference in eh_frame section offset](https://junglewise.ai/threats/cve-2026-91779-gnu-binutils-null-pointer-dereference-in-eh-frame-section-offset)
- [GNU Binutils memory corruption in ELF string table handling](https://junglewise.ai/threats/cve-2026-90831-gnu-binutils-memory-corruption-in-elf-string-table-handling)