3.7
LowCVSS 3.1 · from redhat
CVE-2026-115456
Gcc: out-of-bounds read in std::from_chars
gcc · Out-of-bounds read · CWE-125Affectedgcc, gcc-toolset-15-gcc, gcc-toolset-16-gcc and 24 more
FixNo fix listed yet.
PublishedOct 30, 08:21 · redhat
ScoredOct 30 · 3.7 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
From redhat
Affected and fixed versions
ProductAffectedFixed ingccall versions–gcc-toolset-15-gccall versions–gcc-toolset-16-gccall versions–mingw-gccall versions–compat-gcc-295not stated–compat-gcc-296not stated–compat-gcc-32not stated–compat-gcc-34not stated–gccnot stated–compat-gcc-32not stated–compat-gcc-34not stated–compat-gcc-44not stated–gccnot stated–gccnot stated–gcc-toolset-14-gccnot stated–gcc-toolset-15-gccnot stated–mingw-gccnot stated–gccall versions–gcc-toolset-14-gccall versions–gcc-toolset-15-gccall versions–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known