CVE-2026-115456
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
Risk Assessment
Applications using std::from_chars() in libstdc++ may crash or process invalid data, leading to service unavailability or application logic errors.
Recommendation
Upgrade GCC/libstdc++ to a version containing the fix. Until deployed, ensure strings passed to std::from_chars() are properly null-terminated.
Other vulnerabilities in GCC libstdc++
See all- CVE-2026-115455Medium
A flaw was found in GCC libstdc++: when an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker able to supply crafted input to an affected application could trigger a stack-based buffer overflow leading to denial of service (DoS).
- CVE-2026-114691Medium
A flaw was found in the libstdc++ component of GCC: an attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or denial of service (DoS) during subsequent operations.
- CVE-2026-114690Medium
A flaw was found in GCC: an out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to denial of service (DoS).
Original NVD description (English source)
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS