The Red Hat Hardened Images RPMs include binutils packages affected by multiple vulnerabilities including CVE-2026-3441, a heap-based buffer overflow in the bfd linker. This flaw allows an attacker to cause an out-of-bounds read when processing a specially crafted XCOFF object file, potentially exposing sensitive information or causing application crashes. Exploitation requires a local attacker to convince a user to process malicious files, limiting the attack vector. Red Hat's advisory (RHSA-2026:33527) covers this and related CVEs but does not currently provide a patch. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and CWE-122 (Heap-based Buffer Overflow).

Successful exploitation can lead to disclosure of sensitive information such as cryptographic keys or memory addresses, which could aid further attacks. It can also cause application crashes resulting in denial of service. The attack requires local user interaction with crafted files, limiting remote exploitation. There are no known exploits in the wild at this time.

Currently, no official fix or patch is available for these vulnerabilities in the affected binutils packages. Red Hat states that mitigations either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should avoid processing untrusted XCOFF object files with the affected binutils linker until a fix is released. Monitor Red Hat advisories for updates and apply patches once available.