Quick answers
- Is CVE-2026-3442 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3442 being exploited in the wild.
- How severe is CVE-2026-3442?
- Medium severity, with a CVSS score of 6.1, published 16 March 2026.
- Which products and versions are affected?
- Gnu Binutils Versions prior to 2.45.1-5.1.hum1.
- Is there a fix for CVE-2026-3442?
- A patch was published on 2026-06-30: Red Hat released security update RHSA-2026:33527 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-3442 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-3442?
- Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow, specifically an out-of-bounds read, exists in the Binary File Descriptor (BFD) linker component of GNU Binutils. The flaw is located in 'bfd/xcofflink.c' within the 'xcoff_link_add_symbols' function, where the 'r_symndx' variable is used to index symbol hashes without adequate bounds checking. An attacker can exploit this by providing a specially crafted XCOFF object file to the 'ld' linker. Successful exploitation requires user interaction (processing the malicious file) and can result in information disclosure or an application-level denial of service (crash). Red Hat has released patches for affected components in Red Hat Hardened Images (e.g., binutils-2.45.1-5.1.hum1).
Affected products
- GNU Binutils Versions prior to 2.45.1-5.1.hum1
- Red Hat Enterprise Linux 6 Affected
- Red Hat Hardened Images Affected
Timeline
- 2026-03-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-03-16: advisory: NVD publication date
- 2026-06-30: patched: Red Hat released security update RHSA-2026:33527