CVE-2026-3994: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3994 is a heap-based buffer overflow vulnerability in rui314 mold, a modern high-performance Unix linker, affecting versions up to and including 2.40.4. The flaw resides in the mold::ObjectFile<mold::X86_64>::initialize_sections function within src/input-files.cc of the Object File Handler component. It was reported on February 9, 2026 via a GitHub issue and published to NVD on March 12, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (VulDB, ENISA EUVD).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-122), specifically a heap-based buffer overflow. When mold processes a crafted ELF object file, the initialize_sections function reads 8 bytes significantly past the end of a 112-byte heap-allocated region (up to 1,784 bytes out-of-bounds, as confirmed by AddressSanitizer output), likely due to insufficient validation of section count or index fields within the malicious object file. A secondary crash path also exists in mold::ObjectFile::get_section at src/mold.h:3148, triggered during parallel symbol resolution, and a segmentation fault was observed in mold::is_gcc_lto_obj at src/filetype.cc:39 during file type detection. Exploitation requires local access and the ability to supply a crafted object file as input to the linker (GitHub Issue, VulDB).

Successful exploitation can result in limited confidentiality, integrity, and availability impacts on the affected system, consistent with the CVSS scoring. An attacker who can cause mold to process a malicious object file may trigger a crash (denial of service to the build process) or potentially read out-of-bounds heap memory, which could expose sensitive data from the linker's address space. Because mold operates as a local build tool, the blast radius is generally confined to the developer's workstation or CI/CD build environment, with no direct path to lateral movement unless the build system has elevated privileges (VulDB, GitHub Issue).

A public proof-of-concept reproducer file is available at the reporter's GitHub repository, and the exploit maturity is rated as Proof-of-Concept (CVSS 4.0 E:P) (PoC Reproducer, VulDB). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability was detected by Nessus plugin 301960 (Tenable).

1. Craft or obtain a malicious object file: Use the publicly available reproducer file (repro) from the reporter's GitHub repository, or craft a custom ELF object file with manipulated section headers that cause an out-of-bounds section count or index.
2. Gain local access to a system running a vulnerable mold version: Confirm the installed mold version is ≤ 2.40.4 (e.g., mold --version).
3. Invoke mold with the malicious input: Run mold -r <crafted_object_file> or supply the crafted file as part of a normal build invocation that uses mold as the linker.
4. Trigger the overflow: mold's ObjectFile::parse() allocates a sections vector, then initialize_sections() reads beyond the allocated heap region when processing the malformed section data, resulting in a heap-buffer-overflow read or segmentation fault.
5. Observe the outcome: The process crashes (denial of service to the build), or out-of-bounds heap memory is read, potentially leaking data from the linker process's heap (GitHub Issue, PoC Reproducer).

• Process: Unexpected crash or abort of the mold linker process during a build, particularly with an AddressSanitizer report referencing src/input-files.cc:496 or src/mold.h:3148.
• Logs: Build logs showing AddressSanitizer: heap-buffer-overflow or SEGV on unknown address originating from mold::ObjectFile::initialize_sections, mold::ObjectFile::get_section, or mold::is_gcc_lto_obj.
• File System: Presence of unexpected or externally supplied object files (.o) in build directories that were not generated by the local compiler toolchain.
• Network: In CI/CD environments, unexpected downloads of object files or build artifacts from untrusted sources prior to a mold invocation.

The mold project maintainer had not responded to the issue report as of the time of disclosure, and no official patch or fixed version has been confirmed for this specific CVE. Users should upgrade to mold 2.41.0 or later (released April 13, 2026), which is the most recent release and may include relevant fixes, though users should verify the changelog (mold GitHub). As a workaround, avoid processing untrusted or externally sourced object files with mold, and restrict build environments so that only trusted inputs are linked. Organizations using mold in CI/CD pipelines should enforce input validation and integrity checks (e.g., checksums) on all object files before linking.

The vulnerability was reported by researcher "oneafter" via a GitHub issue on February 9, 2026, with a public reproducer file provided. The mold project maintainer had not responded to the issue at the time of CVE publication. Red Hat tracked the CVE in their security advisory database, and ENISA registered it as EUVD-2026-11537. No significant broader media coverage or notable researcher commentary beyond the initial report has been identified (GitHub Issue, Red Hat CVE, ENISA EUVD).