Description
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element:

1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive)
2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call
3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging

The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable.

An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE.

The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.
Published: 2026-08-12
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Multiple Use‑After‑Free vulnerabilities were identified in GNU ld's add_archive_element function when link‑time optimization (LTO) plugins are enabled. The flaw arises from pointer reuse after freeing a BFD object, causing dangling pointers that are later dereferenced. This conditions can trigger a segmentation fault, leading to a linker crash and thereby a denial of service. While theoretical heap manipulation could permit arbitrary code execution, the strong hardening defaults in Red Hat builds (stack protector, FORTIFY_SOURCE, ASLR, PIE) substantially mitigate that risk. The affected products are all Red Hat systems that ship the binutils toolchain with LTO support. This includes Red Hat Enterprise Linux 6, 7, 8, 9 and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The vulnerable code path is compiled into the default binutils build, so any installation of these products that uses LTO‑enabled linking is at risk. The CVSS score of 5.5 places the vulnerability in the moderate category. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalog. The realistic attack surface is limited to build-time environments such as CI/CD pipelines or developer workstations, where an attacker who can supply a crafted object or archive file could trigger the crash. The most likely mitigation involves deploying the patched binutils package or disabling LTO/plug‑in support in trusted build processes.

Affected Systems

Red Hat Enterprise Linux versions 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 all contain the vulnerable binutils tools. Any installation that uses LTO‑enabled linking via the ld linker is potentially affected.

Risk and Exploitability

The moderate CVSS score and the lack of an EPSS value indicate a moderate risk level, with a realistic exploitation vector confined to build environments. Supply‑chain attackers who can embed malicious object files into build dependencies in CI/CD pipelines or developer workstations are the primary threat. Hardening measures such as ASLR and stack protection reduce the likelihood of gaining arbitrary code execution, making a denial‑of‑service through a linker crash the most plausible outcome.

Generated by OpenCVE AI on August 13, 2026 at 00:22 UTC.

Remediation

Vendor Workaround

Build environments should avoid running LTO-enabled linking (ld with plugin support) against untrusted or externally-supplied object and archive files. The linker is a build-time tool, not present in production runtimes, so the realistic exposure is to CI/CD pipelines and developer workstations that build from untrusted or externally-contributed sources (supply-chain style attack). Standard hardening measures (ASLR, stack protector, FORTIFY_SOURCE, PIE) substantially reduce the likelihood of arbitrary code execution via heap manipulation, limiting the more realistic impact to a linker crash (denial of service).

OpenCVE Recommended Actions

  • Update the binutils package to a version that includes the LTO plugin fix.
  • If LTO‑enabled linking cannot be avoided, disable plugin support or refrain from using LTO for untrusted or externally supplied objects.
  • Ensure CI/CD and developer workflows only incorporate object files and archives from trusted sources and subject all inputs to formal review before inclusion in builds.

Generated by OpenCVE AI on August 13, 2026 at 00:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 13 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu binutils
Redhat adminutil
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Gnu
Gnu binutils
Redhat adminutil
Redhat hardened Images
Redhat openshift Container Platform

Wed, 12 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.
Title Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-416
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Gnu Binutils
Redhat Adminutil Enterprise Linux Hardened Images Hummingbird Openshift Openshift Container Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-01T12:48:18.097Z

Reserved: 2026-08-11T14:15:00.089Z

Link: CVE-2026-19548

cve-icon Vulnrichment

Updated: 2026-08-12T16:52:55.341Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-12T16:16:55.777

Modified: 2026-09-01T13:18:13.000

Link: CVE-2026-19548

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-12T13:40:00Z

Links: CVE-2026-19548 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:39:23Z

Weaknesses