RHSA-2026:82359MediumCVSS 5.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 13, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-19548 →

📋 Description

CVE-2026-19548 — binutils: binutils: Multiple Use-After-Free in add_archive_element via LTO plugin processing

🎯 Affected products13

  • Red Hat Hardened Images
  • binutils-0:2.46.1-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • binutils-0:2.46.1-1.4.hum1@s390x as a component of Red Hat Hardened Images
  • binutils-0:2.46.1-1.4.hum1@src as a component of Red Hat Hardened Images
  • binutils-0:2.46.1-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • binutils-devel-0:2.46.1-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • binutils-devel-0:2.46.1-1.4.hum1@s390x as a component of Red Hat Hardened Images
  • binutils-devel-0:2.46.1-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • binutils-gold-0:2.46.1-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • binutils-gold-0:2.46.1-1.4.hum1@s390x as a component of Red Hat Hardened Images
  • binutils-gold-0:2.46.1-1.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • binutils-gprofng-0:2.46.1-1.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • binutils-gprofng-0:2.46.1-1.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Build environments should avoid running LTO-enabled linking (ld with plugin support) against untrusted or externally-supplied object and archive files. The linker is a build-time tool, not present in production runtimes, so the realistic exposure is to CI/CD pipelines and developer workstations that build from untrusted or externally-contributed sources (supply-chain style attack). Standard hardening measures (ASLR, stack protector, FORTIFY_SOURCE, PIE) substantially reduce the likelihood of arbitrary code execution via heap manipulation, limiting the more realistic impact to a linker crash (denial of service).

🔗 References (5)