GNU Binutils EUVD-2026-57318

Three conditions must be simultaneously true: first, the binutils package must be compiled with --enable-plugins and --enable-lto (confirmed as the default for Red Hat's official binutils packages on RHEL 6 through 10); second, LTO linking must be active in the build invocation, meaning -flto or an equivalent flag is present in the link command so that link_info.lto_plugin_active evaluates to true; third, the attacker-supplied input must be a standalone object file where abfd->my_archive equals NULL - this is a valid, non-exceptional state for object files that are not members of an archive, so no malformed file structure is required beyond the free-triggering condition. Limiting factors: the linker is not exposed as a network service and has no remote attack surface; a human or automated process must explicitly invoke ld against the crafted input (UI:R per CVSS); builds not using LTO are entirely unaffected regardless of plugin configuration; and reliable code execution (beyond DoS) is additionally constrained by RHEL's default hardening stack.

The CVSS 3.1 score of 5.5 (Medium) accurately reflects the constrained attack surface: AV:L requires local file-supply access, UI:R mandates that a developer or automated build process invoke the linker, and the confirmed impact is availability only (A:H). No EPSS score is included in the provided data, so exploitation probability cannot be quantified from that signal. KEV status is absent and no public POC is confirmed, so the exploitation status remains theoretical. The theoretical RCE pathway noted in the tags is substantially mitigated by modern hardening on RHEL systems - stack protector, FORTIFY_SOURCE, ASLR, and PIE collectively make reliable heap manipulation for code execution difficult; the primary confirmed impact is denial of service via segfault. Real-world priority is moderate: even a mid-sized software development team in gniezno running RHEL-based CI/CD infrastructure should assess their build dependency vetting practices rather than treating this as an emergency patch, since exploitation requires an attacker to inject a crafted object file into the build graph - a meaningful but not trivial prerequisite. The discrepancy between the 'RCE' tag and the description's hardening caveats should be noted: RCE is theoretically in scope per CWE-416 but is not reliably achievable on standard RHEL hardened builds.

An attacker compromises or impersonates an upstream library or package repository and introduces a crafted standalone object file (with my_archive set to NULL) into a project's build dependency. When a developer or CI/CD pipeline links this object file using an LTO-enabled binutils build on RHEL, plugin_maybe_claim() frees the BFD object and the subsequent dereference of the dangling abfd pointer in add_archive_element() triggers a segmentation fault, crashing the linker and breaking the build. No confirmed public POC exists; achieving code execution beyond DoS would require defeating ASLR, stack protector, and PIE simultaneously on a hardened RHEL system.