CVE-2026-3442
Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker
- State
- Published
- Severity
- 6.1 Medium
- Published
- Mar 15, 2026
- Updated
- Sep 1, 2026
- Reserved
- Mar 2, 2026
Description
A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L | redhat |
Weaknesses
- CWE-125 Out-of-bounds Read
Affected Products
| Product | Versions |
|---|---|
Red Hat Hardened ImagesRed Hat |
|
Red Hat Hardened ImagesRed Hat |
|
Red Hat Enterprise Linux 10Red Hat | |
Red Hat Enterprise Linux 10Red Hat | |
Red Hat Enterprise Linux 10Red Hat | |
Red Hat Enterprise Linux 10Red Hat | |
Red Hat Enterprise Linux 6Red Hat | |
Red Hat Enterprise Linux 7Red Hat | |
Red Hat Enterprise Linux 7Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat |
References
- RHSA-2026:33527vendor-advisory
- RHSA-2026:39022vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-3442vdb-entry
- RHBZ#2443828issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.