CVE-2026-3994: mold Linker Buffer Overflow Vulnerability

CVE-2026-3994 Overview

A heap-based buffer overflow vulnerability has been identified in the mold linker, a high-performance drop-in replacement for existing Unix linkers. The vulnerability exists in the mold::ObjectFile<mold::X86_64>::initialize_sections function within the Object File Handler component. When processing specially crafted object files, the vulnerable function fails to properly validate input boundaries, resulting in a heap-based buffer overflow condition.

Critical Impact
Local attackers with access to the build environment can supply malicious object files to trigger a heap-based buffer overflow, potentially leading to arbitrary code execution during the linking process or denial of service.

Affected Products

rui314 mold versions up to 2.40.4
Systems using mold as the default linker for compilation workflows
Build environments and CI/CD pipelines utilizing vulnerable mold versions

Discovery Timeline

2026-03-12 - CVE CVE-2026-3994 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3994

Vulnerability Analysis

This vulnerability falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the section initialization logic within src/input-files.cc, specifically in how the linker processes object file sections for X86_64 architecture targets. When parsing malformed or adversarial object files, the initialize_sections function fails to enforce proper bounds checking on section header data.

The heap-based buffer overflow occurs because the function allocates memory based on potentially untrusted section count or size values from the object file headers without adequate validation. An attacker can craft an object file with malicious section headers that cause the linker to write beyond the allocated heap buffer boundaries.

The vulnerability requires local access to exploit, meaning an attacker must be able to supply malicious object files to the build process. This could occur in scenarios such as compromised source code repositories, supply chain attacks, or malicious contributions to open source projects.

Root Cause

The root cause stems from insufficient bounds validation in the mold::ObjectFile<mold::X86_64>::initialize_sections function when processing ELF section headers. The function reads section metadata from input object files and uses these values to allocate and populate internal data structures without properly validating that the provided sizes and offsets are within safe bounds.

Attack Vector

Exploitation requires local access to the target system or build environment. The attacker must be able to provide a malicious object file to the mold linker during compilation or linking operations. Attack scenarios include:

Supply Chain Attack: Injecting malicious object files into a software repository
Build Environment Compromise: Placing crafted object files in locations where the linker will process them
Malicious Dependencies: Distributing compromised libraries containing the malicious object files

The vulnerability is publicly known and a proof-of-concept has been made available. According to the CVE description, the project maintainers were notified through an issue report but had not responded at the time of disclosure.

The technical details of the vulnerability can be examined through the GitHub Mold Issue #1548 and the PoC Repository.

Detection Methods for CVE-2026-3994

Indicators of Compromise

Unexpected crashes or segmentation faults during mold linking operations
Anomalous memory access patterns in build processes utilizing mold
Presence of unusually structured or malformed object files in build directories
Build failures with heap corruption errors when using mold linker

Detection Strategies

Monitor build systems for unexpected mold process crashes or memory errors
Implement file integrity monitoring on object files and build artifacts
Deploy memory sanitizers (ASan, MSan) in development and CI environments to detect heap overflows
Review build logs for unusual section counts or sizes in processed object files

Monitoring Recommendations

Enable Address Sanitizer (ASan) in build pipelines to detect memory corruption during linking
Configure system-level monitoring for abnormal memory usage by mold processes
Implement audit logging for object file inputs to the linker
Set up alerts for repeated build failures that may indicate exploitation attempts

How to Mitigate CVE-2026-3994

Immediate Actions Required

Audit all build systems and development environments for mold versions up to 2.40.4
Consider temporarily switching to alternative linkers (such as GNU ld or LLVM lld) until a patch is available
Restrict access to build environments and validate the source of all object files
Implement object file validation or sandboxing before passing files to the linker

Patch Information

At the time of this writing, the mold project maintainers have been notified through GitHub Issue #1548 but have not yet released an official patch. Monitor the mold GitHub repository for security updates and new releases that address this vulnerability.

Organizations should subscribe to the project's release notifications and apply patches immediately once they become available. Additional vulnerability tracking information is available through VulDB #350476.

Workarounds

Use alternative linkers such as GNU ld or LLVM lld as a temporary mitigation
Compile mold with memory sanitizers to detect exploitation attempts
Implement strict access controls on build environments to prevent unauthorized object file injection
Deploy build process sandboxing to limit the impact of potential exploitation

bash

# Temporary workaround: Switch to alternative linker
# For GCC builds, override the linker
export LDFLAGS="-fuse-ld=lld"

# For CMake projects
cmake -DCMAKE_LINKER=/usr/bin/ld.lld ..

# For Cargo/Rust projects, update .cargo/config.toml
# [target.x86_64-unknown-linux-gnu]
# linker = "clang"
# rustflags = ["-C", "link-arg=-fuse-ld=lld"]