CVE-2026-115455
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A flaw was found in GCC libstdc++: when an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker able to supply crafted input to an affected application could trigger a stack-based buffer overflow leading to denial of service (DoS).
Risk Assessment
Applications built with libstdc++ that process user-supplied input could be remotely crashed, resulting in service unavailability.
Recommendation
Update GCC/libstdc++ to a patched version and rebuild affected applications; until then, limit acceptance of untrusted input in applications using wide-character stream bitset extraction.
Other vulnerabilities in GCC libstdc++
See all- CVE-2026-115456Low
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
- CVE-2026-114691Medium
A flaw was found in the libstdc++ component of GCC: an attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or denial of service (DoS) during subsequent operations.
- CVE-2026-114690Medium
A flaw was found in GCC: an out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to denial of service (DoS).
Original NVD description (English source)
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS