CVE-2026-19548
published 2026-08-12CVE-2026-19548: Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root…
PriorityP425medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.17%
5.7th percentile
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element:
1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive)
2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call
3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging
The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable.
An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE.
The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | binutils | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing
vendor_redhat·2026-08-12·CVSS 5.5
CVE-2026-19548 [MEDIUM] CWE-416 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing
binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element:
1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive)
2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_ge
GHSA
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils.
ghsa_unreviewed·2026-08-12
CVE-2026-19548 [MEDIUM] CWE-416 Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils.
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element:
1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive)
2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call
3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19548 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing [fedora-all]
bugzilla·2026-08-12·CVSS 5.5
CVE-2026-19548 [MEDIUM] CVE-2026-19548 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing [fedora-all]
CVE-2026-19548 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
*** This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-17918 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket. ***
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU
Bugzilla
CVE-2026-19548 mingw-binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing [fedora-all]
bugzilla·2026-08-12·CVSS 5.5
CVE-2026-19548 [MEDIUM] CVE-2026-19548 mingw-binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing [fedora-all]
CVE-2026-19548 mingw-binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
*** This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-17918 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket. ***
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of th
Bugzilla
CVE-2026-19548 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing
bugzilla·2026-07-27·CVSS 5.5
CVE-2026-19548 [MEDIUM] CVE-2026-19548 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing
CVE-2026-19548 binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing
*** This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-17918 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket. ***
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original
2026-08-12
Published