Rigelyoung

Multiple Use-After-Free issues exist in the `add archive element()` function within the GNU linker (ld), a component of binutils. The problem occurs when `plugin maybe claim()` in ld/plugin.c frees the original BFD object via `bfd close()` or ` bfd delete bfd()` while the caller still holds the `abfd` parameter and a shallow copy `orig input.the bfd` as dangling pointers. These pointers are later dereferenced in three locations within `add archive element()`: accessing `abfd->my archive` via `bfd usrdata()`, performing conditional checks and `bfd get filename()` calls, and during trace/verbose logging. This is triggered when LTO (Link Time Optimization) plugins are active and the input object has `abfd->my archive` set to NULL. An attacker providing a crafted object or archive file during a build process using LTO-enabled linking could cause a denial of service via a linker crash. While arbitrary code execution is theoretically possible through heap manipulation, it is mitigated by system hardening measures. The primary risk is a supply chain attack targeting CI/CD pipelines or development environments.

A use-after-free issue occurs when freetype initialization fails. In this scenario, the system fails to exit and continues to access memory that has already been released. This flaw can be triggered during image processing and may result in a denial of service.

A use-after-free issue exists in the `FormatMagickCaption()` function. This occurs when memory allocation fails, causing a dangling pointer to reference memory that has already been freed. An attacker can trigger these allocation failures to potentially cause a denial of service or execute arbitrary code.