PT-2026-24929 · Debian+2 · Mold

Oneafter · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-3994

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions rui314 mold versions up to 2.40.4

Description A flaw exists in rui314 mold, specifically within the mold::ObjectFilemold::X86 64::initialize sections function located in the src/input-files.cc file of the Object File Handler component. A manipulation of the input can lead to a heap-based buffer overflow. Local access is required for exploitation. The exploit for this issue is publicly available. The project maintainers were notified of the problem but have not yet responded.

Recommendations Versions up to 2.40.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-119

Related Identifiers

CVE-2026-3994

Affected Products

Mold

References · 18

• 🔥 https://github.com/oneafter/0209/blob/main/mo2/repro · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3994 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3994 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3994 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3994 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3994 · Security Note
• https://ubuntu.com/security/CVE-2026-3994 · Vendor Advisory
• https://github.com/rui314/mold/issues/1548 · Note
• https://twitter.com/CVEarity/status/2032092216223809826 · Twitter Post
• https://vuldb.com/?submit.769772 · Note
• https://vuldb.com/?id.350476 · Note
• https://twitter.com/CVEnew/status/2031992327179493490 · Twitter Post
• https://t.me/CVEtracker/47236 · Telegram Post
• https://vuldb.com/?ctiid.350476 · Note