EUVD-2026-113745
GHSA-36h8-gj54-w3vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to host
-
DeliverySupply crafted search data to app
-
ExploitOverflow undersized parallel-mode buffer
-
ExecutionOut-of-bounds memory access
-
ImpactProcess crash / Denial of Service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to be compiled with libstdc++ parallel mode (the __gnu_parallel / _GLIBCXX_PARALLEL path) and to perform a parallel search over data the attacker can influence; the out-of-bounds access is triggered by crafted search data hitting the undersized internal buffer. Limiting factors: the attack vector is local (AV:L), so the attacker needs local access to feed input to the process; and parallel mode is a non-default, opt-in compilation feature, so ordinary applications built without it are not affected. Impact is limited to a crash/DoS - there is no confidentiality or integrity impact (C:N/I:N). |
| Impact | This is a genuinely moderate-to-low real-world risk, and the signals are largely consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) correctly characterizes this as a local, availability-only issue: no confidentiality or integrity impact, only a process crash (DoS). Although PR:N indicates no authentication is needed to feed the malicious input, the attack vector is local (AV:L) and, critically, only affects applications explicitly compiled with libstdc++ parallel mode and processing attacker-influenced search data. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a non-urgent, availability-only defect. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or widespread exploitation - consistent with a crash-only bug that requires a narrow, non-default compilation path. The main caveat: the report comes solely from Red Hat (CVE page + Bugzilla), with no upstream GCC advisory or fixed version supplied, so patch and affected-version details cannot be independently confirmed from this data. |
| Exploit ScenarioDerived | An application on the host has been compiled with libstdc++ parallel mode (e.g. via _GLIBCXX_PARALLEL) and performs a parallel search over data that a local user can influence. The attacker supplies crafted search input that overflows the undersized internal buffer, triggering an out-of-bounds access that crashes the process and denies service. No public exploit code was identified in the provided data, and the local attack vector plus the requirement that the target be built with parallel mode significantly limit practical impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
RemediationAI
No vendor-released patch was identified at time of analysis; Red Hat is tracking the flaw through its CVE page (https://access.redhat.com/security/cve/CVE-2026-114690) and Bugzilla entry 2478652, so affected RHEL 6 through 10 and derived products such as OpenShift Container Platform 4/5 and Red Hat Hardened Images should be monitored for errata and updated libstdc++/GCC packages once they publish. In the interim, the most direct compensating control is to rebuild affected applications without parallel mode - drop _GLIBCXX_PARALLEL and avoid the __gnu_parallel algorithm path - accepting the trade-off that parallel algorithm acceleration is lost; alternatively, keep parallel mode but ensure parallel search is never run over attacker-influenced data by restricting untrusted input to code paths that do not use the parallel search implementation. Neither control removes the defect from the library, so reintroduction of parallel mode over untrusted input should be treated as re-exposing the DoS condition.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the parallel algorithms layer of GCC's libstdc++, which is enabled at compile time via the _GLIBCXX_PARALLEL macro and routes standard algorithms through the __gnu_parallel namespace. In this mode, a parallel search operation allocates an internal buffer that is undersized relative to the crafted search input, so the operation writes past the buffer boundary - an out-of-bounds memory access classified as CWE-787 (out-of-bounds write). Because parallel mode is a non-default, opt-in compilation feature, ordinary applications built against libstdc++ without it do not exercise the affected code path; applications that do enable it and run parallel searches over attacker-influenced data are the exposed set. The trigger requires local access to feed the crafted data into the process, and the observable consequence is a crash rather than data disclosure or corruption of application semantics.
Know when Gcc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local delivery of crafted data to a parallel-mode build (AV:L, AC:L, PR:N, no UI); crash-only so A:H with C:N/I:N and no scope change.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. Rated high sev
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new. Rated m
**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to
The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_dar
Use-after-free in GCC's libstdc++ handling of erase_if on a binary-heap priority queue (std::priority_queue) allows unau
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-char
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsist
The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which
The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle
Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program pas
Exploit-DB