CVE-2026-19548

Name of the Vulnerable Software and Affected Versions binutils (affected versions not specified)

Description Multiple Use-After-Free issues exist in the add archive element() function within the GNU linker (ld), a component of binutils. The problem occurs when plugin maybe claim() in ld/plugin.c frees the original BFD object via bfd close() or bfd delete bfd() while the caller still holds the abfd parameter and a shallow copy orig input.the bfd as dangling pointers. These pointers are later dereferenced in three locations within add archive element(): accessing abfd->my archive via bfd usrdata(), performing conditional checks and bfd get filename() calls, and during trace/verbose logging. This is triggered when LTO (Link Time Optimization) plugins are active and the input object has abfd->my archive set to NULL. An attacker providing a crafted object or archive file during a build process using LTO-enabled linking could cause a denial of service via a linker crash. While arbitrary code execution is theoretically possible through heap manipulation, it is mitigated by system hardening measures. The primary risk is a supply chain attack targeting CI/CD pipelines or development environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.