# CVE-2026-19548: GNU binutils ld use-after-free in add_archive_element

Source: https://junglewise.ai/threats/cve-2026-19548-gnu-binutils-ld-use-after-free-in-add-archive-element  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19548 · Severity: medium · CVSS 5.5 · Published 2026-08-12

The GNU linker (ld), a compiler component used in build systems to combine object files into executables, contains use-after-free memory safety flaws in its plugin handling code. An attacker who can inject a crafted object file into a build process could crash the linker or potentially execute arbitrary code, disrupting software builds and potentially compromising the resulting binaries in supply-chain scenarios.

Technologies: [Gnu Binutils](https://junglewise.ai/threats/technologies/binutils). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-19548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19548 being exploited in the wild.

**How severe is CVE-2026-19548?** Medium severity, with a CVSS score of 5.5, published 12 August 2026.

**Which products and versions are affected?** Gnu Binutils <UNKNOWN>.

**Is there a fix for CVE-2026-19548?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19548 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-19548?** Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple use-after-free vulnerabilities exist in the add_archive_element function (ld/ldmain.c) of the GNU linker when LTO plugins are active. The root cause is in plugin_maybe_claim() (ld/plugin.c), which frees a BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive is NULL, but the caller retains dangling pointers to both the original abfd parameter and a shallow copy (orig_input.the_bfd). These dangling pointers are dereferenced at three locations: line ~1442 accessing abfd->my_archive, line ~1493 in conditional checks and bfd_get_filename calls, and line ~1525 in trace logging. The vulnerability is reachable when LTO plugins are enabled (confirmed in Red Hat binutils builds with --enable-plugins and --enable-lto) and triggered by standalone object files where abfd->my_archive is NULL. Attack vector is local (build-time tool) requiring attacker ability to supply crafted input files to the linker; exploitation results in denial of service via segmentation fault, with arbitrary code execution theoretically possible but substantially mitigated by stack protector, FORTIFY_SOURCE, ASLR, and PIE. No patch availability status disclosed in advisory.

## Affected products

- GNU binutils <UNKNOWN>

## Timeline

- 2026-08-12: disclosed

## Related threats

- [GNU Binutils null pointer dereference in dynamic relocation allocation](https://junglewise.ai/threats/cve-2026-91782-gnu-binutils-null-pointer-dereference-in-dynamic-relocation)
- [GNU Binutils null pointer dereference in ELF section handler](https://junglewise.ai/threats/cve-2026-91781-gnu-binutils-null-pointer-dereference-in-elf-section-handler)
- [GNU Binutils null pointer dereference in ELF linker](https://junglewise.ai/threats/cve-2026-91780-gnu-binutils-null-pointer-dereference-in-elf-linker)
- [GNU Binutils null pointer dereference in eh_frame section offset](https://junglewise.ai/threats/cve-2026-91779-gnu-binutils-null-pointer-dereference-in-eh-frame-section-offset)
- [GNU Binutils memory corruption in ELF string table handling](https://junglewise.ai/threats/cve-2026-90831-gnu-binutils-memory-corruption-in-elf-string-table-handling)