6.5
MediumCVSS 3.1 · from redhat
CVE-2026-115455
Gcc: stack overflow in std::bitset on libstdc++
gcc · Out-of-bounds write · CWE-787Affectedgcc, gcc-toolset-15-gcc, gcc-toolset-16-gcc and 24 more
FixNo fix listed yet.
PublishedOct 30, 07:13 · redhat
ScoredOct 30 · 6.5 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can take the service down. CVSS impact.
Description
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).
From redhat
Affected and fixed versions
ProductAffectedFixed ingccall versions–gcc-toolset-15-gccall versions–gcc-toolset-16-gccall versions–mingw-gccall versions–compat-gcc-295not stated–compat-gcc-296not stated–compat-gcc-32not stated–compat-gcc-34not stated–gccnot stated–compat-gcc-32not stated–compat-gcc-34not stated–compat-gcc-44not stated–gccnot stated–gccnot stated–gcc-toolset-14-gccnot stated–gcc-toolset-15-gccnot stated–mingw-gccnot stated–gccnot stated–gcc-toolset-14-gccnot stated–gcc-toolset-15-gccnot stated–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known