CVE-2026-3441 Binutils: gnu binutils: information disclosure via specially crafted xcoff object file
An out-of-bounds read in the bfd linker allows attackers to disclose sensitive information or cause denial of service via crafted XCOFF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-3441?
CVE-2026-3441 is a medium-severity vulnerability in Gnu Binutils, published on 15 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2026-3441?
It affects 3 products.
Products include Gnu Binutils, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2026-3441?
Apply the vendor's patch.
Is CVE-2026-3441 being exploited?
There is no known exploitation of CVE-2026-3441 in the wild and no public exploit code.
Other vulnerabilities in Gnu Binutils
Sources
Also known as DEBIAN-CVE-2026-3441, ECHO-8662-7f11-0211, GHSA-8444-p2rx-h3vp, MINI-wg64-4292-3gvh, ROOT-OS-ALPINE-319-CVE-2026-3441, ROOT-OS-ALPINE-321-CVE-2026-3441 and 4 more.