CVE-2026-3994CWE-119CWE-122

rui314 mold Object File input-files.cc initialize_sections heap-based overflow

Medium · published March 12, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

A vulnerability was detected in rui314 mold up to 2.40.4. This issue affects the function mold::ObjectFilemold::X86_64::initialize_sections of the file src/input-files.cc of the component Object File Handler. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00178 · 7.0th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-122 · Heap-based Buffer Overflow
Published
2026-03-12T06:02Z
EPSS history
Timeline
  • 12 MAR 06:02Z
    rui314 mold Object File input-files.cc initialize_sections heap-based overflow
    cvelistv5