The Red Hat security advisory RHSA-2026:33527 addresses multiple vulnerabilities in GNU Binutils packages included in Red Hat Hardened Images RPMs, specifically version 2.45.1-5.1.hum1. Among these, CVE-2026-3441 is a heap-based buffer overflow due to an out-of-bounds read in the bfd linker when processing XCOFF object files. Exploitation requires a local attacker to convince a user to process a maliciously crafted file, which may lead to disclosure of sensitive information or cause an application-level denial of service. The advisory notes that no mitigation meeting Red Hat's standards is currently available, and no patch has been released yet. The vulnerability is rated with a high severity impact by Red Hat, with a CVSS v3.1 base score of 6.1 (Red Hat's assessment). Additional CVEs (CVE-2026-3442, CVE-2026-4647, CVE-2026-6846) are also addressed in this update.

Successful exploitation of CVE-2026-3441 can lead to disclosure of sensitive information such as cryptographic keys or memory addresses, which could facilitate further attacks. It may also cause application crashes or denial of service due to out-of-bounds memory reads. The attack vector is local and requires user interaction with crafted XCOFF object files. The vulnerability affects confidentiality and availability but does not impact integrity. No known exploits are reported in the wild at this time.

Red Hat currently does not provide an official fix or patch for this vulnerability. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use, applicability, or stability. Users are advised to avoid processing untrusted XCOFF object files with the affected binutils linker until a fix is released. Monitoring Red Hat's advisory page for updates and applying updates once available is recommended.