GCC libstdc++ EUVD-2026-113747

Exploitation requires an affected application to invoke std::bitset stream extraction (operator>>) on a wide-character (wchar_t) input stream whose contents are attacker-controlled; the bug is the failure to account for wide-character size and alignment when sizing the internal stack buffer. Limiting factors: this specific wide-char bitset-extraction path must be reachable with untrusted input, which is uncommon in real deployments; the vendor assigns AC:H, indicating non-trivial triggering conditions; impact is limited to a crash (denial of service). Authentication is not required (PR:N per the vendor vector), but the actual attack vector is remote only when the application exposes this path to remote data.

Signals are mixed and point to a moderate, not urgent, priority. The Red Hat-supplied CVSS is 6.5 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, i.e. a high-complexity, unauthenticated issue whose primary consequence is availability loss (A:H) with only limited integrity impact and no confidentiality impact - consistent with the description's denial-of-service outcome. The vuln.today decision label is 'this_month', which signals a scheduled-remediation rather than act_now/emergency posture. No EPSS probability is provided in the input, there is no CISA KEV listing, and no exploit/PoC reference is present (the only GCC link is the fix commit, not exploit code); therefore there is no public exploit identified at time of analysis. The practical risk is bounded by reachability: although libstdc++ is ubiquitous, the vulnerable path is the specific case of extracting into std::bitset from a wide-character stream with attacker-controlled input, which most applications never expose. Note explicitly that EPSS is MISSING from the input, so exploitation-probability cannot be quantified here, and that AV:N is inherited from the vendor vector but is only meaningful for applications that actually feed remote/untrusted data into this code path - verify reachability per application.

An attacker supplies a crafted wide-character stream to an application that uses std::bitset stream extraction (operator>>) on untrusted input; because the internal stack buffer is sized without properly accounting for wide-character size and alignment, the write overflows adjacent stack memory and crashes the process (DoS). The CVSS AC:H suggests the overflow is not trivially triggered on every input, and no public exploit has been identified - only the upstream GCC fix commit is referenced.