CVE-2026-3441: Binutils: gnu binutils: information disclosure via specially crafted xcoff object file
A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.
Other sources
Summary: A heap-based buffer overflow (Out-of-Bounds Read) was found in GNU Binutils (bfd linker). The vulnerability occurs in bfd/xcofflink.c in the xcofflinkaddsymbols function. It is caused by an improper check of the xscnlen value, leading to an out-of-bounds access on the csects array. Requirements to exploit: An attacker needs to trick a user into running the ld linker against a specially crafted malicious XCOFF object file.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3441?
CVE-2026-3441 is classified as a medium-severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-3441?
To mitigate CVE-2026-3441, upgrade to the latest version of GNU Binutils provided by your distribution.
What causes CVE-2026-3441?
CVE-2026-3441 is caused by a heap-based buffer overflow during the processing of specially crafted xcoff object files.
What types of systems are affected by CVE-2026-3441?
CVE-2026-3441 affects systems that use GNU Binutils, particularly environments where xcoff object files are utilized.
Can CVE-2026-3441 lead to remote attacks?
CVE-2026-3441 does not directly lead to remote attacks, but it allows attackers to exploit sensitive information from affected systems.