Red Hat Hardened Images CVE-2026-95619

Exploitation requires an application linked against the vulnerable libstdc++ that passes an attacker-controllable large value (element count or size) into the C++ new / new[] operator such that the size computation integer-overflows (CWE-190). It is not exploitable against libstdc++ in isolation - a consuming program must expose an input path reaching an allocation with an untrusted size, and the resulting undersized buffer must then be written past its bounds. Limiting factors: AC:H reflects the need for a specific overflowing input and exploitable heap layout; there is no authentication requirement inherent to the library (PR:N), but real-world reachability depends entirely on the specific application, its input validation, and deployment. No user interaction is required by the library flaw itself (UI:N).

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H, base 7.7, Red Hat-assigned) rates this High, driven by I:H/A:H from memory corruption plus AC:H reflecting the specialized conditions needed. However, several signals argue against treating this as an urgent priority: this is a flaw in libstdc++ (the GNU C++ standard library), not a directly network-facing service, so the AV:N is inherited worst-case and is entirely contingent on a downstream application forwarding attacker-controlled large size values into the C++ new operator. There is no EPSS score, no CISA KEV listing, and no public exploit code - the only references are the Red Hat CVE page and Bugzilla, meaning this reflects vendor tracking rather than observed exploitation. No SSVC decision data is provided. The realistic exploitation status is 'no public exploit identified at time of analysis.' Net: a genuinely severe class of bug (integer-overflow-to-undersized-allocation, CWE-190) in a ubiquitous library, but the abstract per-application exploitability and absence of any exploitation signal place it as a patch-in-normal-cycle item rather than an emergency, except where an exposed application demonstrably passes untrusted large sizes to allocation.

An application built against a vulnerable libstdc++ accepts an attacker-influenced large count/size (e.g. a length field or element count) and passes it to the C++ new (or new[]) operator; the size computation overflows, producing an undersized heap allocation while the program believes it received a larger buffer. Subsequent writes overflow the allocation, corrupting adjacent heap memory and potentially enabling code execution or a crash. No public proof-of-concept is available, and the AC:H rating reflects that a suitable overflowing input path and favorable memory layout are required.