This vulnerability in GNU Binutils, specifically in the bfd linker used by Red Hat Enterprise Linux 10, is caused by a heap-based buffer overflow resulting from an out-of-bounds read. The flaw can be triggered when a user processes a maliciously crafted XCOFF object file, which may lead to sensitive information disclosure or cause an application to crash, resulting in denial of service. The CVSS 3.1 score is 6.1, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to disclosure of sensitive information and application-level denial of service. The attack requires local access and user interaction, limiting remote exploitation. There are no reports of active exploitation in the wild at this time.

Patch status is not explicitly stated in the vendor advisory content provided. Users should monitor the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-3441 for updates and apply any available patches or updates promptly. Until a patch is applied, avoid processing untrusted XCOFF object files to mitigate risk.