PT-2026-24929 · Debian+2 · Mold

Oneafter · Publicado 2026-03-12 · Atualizado 2026-03-12 · CVE-2026-3994

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions rui314 mold versions up to 2.40.4

Description A flaw exists in rui314 mold, specifically within the mold::ObjectFilemold::X86 64::initialize sections function located in the src/input-files.cc file of the Object File Handler component. A manipulation of the input can lead to a heap-based buffer overflow. Local access is required for exploitation. The exploit for this issue is publicly available. The project maintainers were notified of the problem but have not yet responded.

Recommendations Versions up to 2.40.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-122

Identificadores relacionados

CVE-2026-3994

Produtos afetados

Mold

Referências · 18

• 🔥 https://github.com/oneafter/0209/blob/main/mo2/repro · Exploit
• https://github.com/rui314/mold/issues/1548 · Nota
• https://vuldb.com/?submit.769772 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3994 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2032013047112319288 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-3994 · Nota de Segurança
• https://t.me/CVEtracker/47236 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2031992327179493490 · Publicação no Twitter
• https://vuldb.com/?id.350476 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3994 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-3994 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2032092216223809826 · Publicação no Twitter
• https://github.com/rui314/mold · Nota
• https://t.me/cveNotify/155236 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3994 · Aviso do Fabricante