Medium

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Type: advisorySource: Official CVE List1 source record

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack pro

Announced 12 Aug 2026Source revision 1

Original source ↗

CVE-2026-19548

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-19548

Red Hat Hardened Images

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 6

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:/a:redhat:hummingbird:1"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Hardened Images",
    "versions": [
      {
        "status": "unaffected",
        "version": "2.46.1-1.4.hum1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "binutils-main",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "packageName": "binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "packageName": "gcc-toolset-15-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "packageName": "gcc-toolset-16-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "packageName": "mingw-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "packageName": "binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "packageName": "binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "packageName": "binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "packageName": "gcc-toolset-14-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "packageName": "gcc-toolset-15-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "packageName": "mingw-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "gcc-toolset-14-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "gcc-toolset-15-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "gcc-toolset-16-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "mingw-binutils",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:openshift:4"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4",
    "packageName": "openshift/ose-rhel-coreos-8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:openshift:4"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4",
    "packageName": "openshift/ose-rhel-coreos-9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  }
]

Related CVEs: CVE-2026-19548
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #21406 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 05:44:49 GMT
Publisher date: Wed, 12 Aug 2026 15:51:39 GMT

Read the original announcement