Description

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-12T16:16:55.777Z",
  "pubdate": "2026-08-12T16:16:55.777Z",
  "executiveSummary": "Multiple Use-After-Free vulnerabilities exist within the add_archive_element function of the GNU linker (ld), which is a core component of binutils. The root cause stems from improper memory management during plugin interactions where the original Binary File Descriptor (BFD) object is prematurely freed via bfd_close and _bfd_delete_bfd. This leaves dangling pointers in the caller context, specifically the original abfd parameter and the shallow copy orig_input.the_bfd.\nThe primary impact of these vulnerabilities is a denial of service resulting from a linker crash via a segmentation fault upon dereferencing the dangling pointers. While theoretical arbitrary code execution via heap manipulation exists, it is substantially mitigated by modern operating system and compiler hardening mechanisms such as stack protectors, FORTIFY_SOURCE, ASLR, and PIE.\nAffected systems include environments utilizing GNU binutils compiled with LTO and plugin support, such as standard Red Hat builds. The attack surface is restricted strictly to build-time environments, as the linker is a development utility rather than a production runtime service.\nSuccessful exploitation requires an attacker to supply a specially crafted object or archive file to a build process operating with active Link-Time Optimization (LTO) plugins. This typically manifests as a supply chain vector where malicious input is introduced as a build dependency within continuous integration or development pipelines.",
  "technicalDetails": "The vulnerability resides in the add_archive_element function located in ld/ldmain.c of the GNU linker, interacting closely with plugin_maybe_claim() in ld/plugin.c. The flaw is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and an input object file possesses an abfd->my_archive state equal to NULL, which represents a standard and valid state for standalone object files.\nDuring the linking process, plugin_maybe_claim() frees the underlying BFD object via bfd_close and _bfd_delete_bfd. However, the calling execution context fails to nullify or update the references, retaining both the original abfd parameter and the shallow copy located at orig_input.the_bfd as dangling pointers.\nThese dangling pointers are subsequently dereferenced at three distinct locations within the add_archive_element function: first, at approximately line 1442, where abfd->my_archive is accessed via bfd_usrdata(abfd->my_archive); second, at approximately line 1493, involving multiple conditional checks and a bfd_get_filename call on abfd and abfd->my_archive; and third, at approximately line 1525, which dereferences the shallow copy orig_input.the_bfd->my_archive during trace and verbose logging operations.\nThe attack flow proceeds sequentially as follows: 1) The attacker crafts a malicious object or archive file designed to satisfy specific plugin claim conditions. 2) The victim initiates a build or compilation process utilizing LTO-enabled linking against the crafted input. 3) The linker executes plugin_maybe_claim(), which claims and subsequently deallocates the BFD object while leaving active references intact. 4) Execution flow continues into add_archive_element, where the linker attempts to read from or write to the dangling pointers during archive element processing and logging. 5) The memory access violation triggers a segmentation fault, terminating the linking process and causing a denial of service.\nAuthentication and privilege requirements are minimal from an application standpoint; the attacker only needs the ability to supply input files to the build process. Network exposure is non-existent as the attack vector is localized entirely to file processing during local or automated builds."
}