6 matches found
CVE-2026-97038
The Go toolchain (cmd/go) is vulnerable to arbitrary code execution at link time when building packages containing malicious .syso files or cgo linker inputs . The root cause is that the go command passed linker input files—including direct object/library inputs in #cgo LDFLAGS and libraries in -...
PT-2026-144961
Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "cgo LDFLAGS", and libraries in "-L" directories—were passed to the...
CVE-2026-97038: Go toolchain cmd/go: Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or…
Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "cgo LDFLAGS", and libraries in "-L" directories—were passed to the...
AZL-95892 CVE-2026-19548 affecting package binutils 2.41-14
Multiple Use-After-Free vulnerabilities were found in the addarchiveelement function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that pluginmaybeclaim in ld/plugin.c frees the original BFD object via bfdclose/bfddeletebfd when entry-thebfd-myarchive == NULL, bu...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the addarchiveelement process when handling object or archive files with LTO plugins enabled. An attacker can cause a crash of the linker process by introducing a specially crafted object or archive file into the build...
PT-2026-71137
Name of the Vulnerable Software and Affected Versions binutils affected versions not specified Description Multiple Use-After-Free issues exist in the add archive element function within the GNU linker ld, a component of binutils. The problem occurs when plugin maybe claim in ld/plugin.c frees th...