GCC libstdc++ CVE-2026-115456

Exploitation requires a downstream application that invokes std::from_chars() on a character buffer that is NOT null-terminated and whose bytes or length the attacker can influence; the out-of-bounds read occurs only in that unsafe calling pattern. It is not triggerable against the GCC compiler or a standalone toolchain by itself - it manifests in programs that link libstdc++ and parse untrusted numeric input without guaranteeing termination. Limiting factors: the high attack complexity (AC:H) reflects the dependence on this specific usage; impact is confined to availability (A:L, a crash or invalid parse) with no confidentiality or integrity effect; and whether the attacker's data reaches a vulnerable from_chars() call is entirely application-specific.

All available signals point to a low real-world priority. The CVSS base score is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning the only impact is a limited availability loss (a crash) with no confidentiality or integrity impact, and the high attack complexity (AC:H) reflects that exploitation depends on a specific unsafe calling pattern rather than a straightforward remote trigger. The vendor decision label is 'monitor', which is consistent with this low-severity picture. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One point of friction to flag: the Tags include 'Buffer Overflow' and 'Information Disclosure', but the CWE is CWE-125 (out-of-bounds read, not an overflow) and the CVSS sets C:N (no confidentiality impact), so those tags overstate the mechanism and impact relative to the authoritative metrics - treat the flaw as a read-driven DoS, not a memory-corruption or data-disclosure issue. This is a genuine but low-urgency defect rather than a high-risk threat.

An application built against libstdc++ that calls std::from_chars() on a character buffer it does not guarantee to be null-terminated - and whose contents or length an attacker can influence - can be driven to read past the end of the allocated buffer, resulting in misparsed data or a crash. Because PR:N applies, remote attackers could reach the vulnerable call where such input flows in from the network, but the high attack complexity reflects dependence on the specific unsafe usage. No public exploit identified at time of analysis.