Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-114690 EUVD-2026-113745GHSA-36h8-gj54-w3vc

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

Published Oct 30, 2026 · Updated Nov 13, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Enterprise Linux 10 Product: Red Hat Enterprise Linux 6 Product: Red Hat Enterprise Linux 7 Product: Red Hat Enterprise Linux 8 Product: Red Hat Enterprise Linux 9 Product: Red Hat Hardened Images Product: Red Hat OpenShift AI (RHOAI) Product: Red Hat OpenShift Container Platform 4 Product: Red Hat OpenShift Container Platform 5 Package: gcc Package: gcc-10 Package: gcc-10-cross Package: gcc-10-cross-mipsen Package: gcc-10-cross-ports Package: gcc-11 Package: gcc-11 Package: gcc-11-cross Package: gcc-11-cross-mipsen Package: gcc-11-cross-ports Package: gcc-12 Package: gcc-12 Package: gcc-12-cross Package: gcc-12-cross-mipsen Package: gcc-12-cross-ports Package: gcc-13 Package: gcc-13 Package: gcc-13-cross Package: gcc-13-cross-ports Package: gcc-14 Package: gcc-15 Package: gcc-16 Package: gcc-3.3 Package: gcc-4.7 Package: gcc-4.7-armel-cross Package: gcc-4.7-armhf-cross Package: gcc-4.8 Package: gcc-4.8-arm64-cross Package: gcc-4.8-armhf-cross Package: gcc-4.8-powerpc-cross Package: gcc-4.8-ppc64el-cross Package: gcc-4.9 Package: gcc-4.9-cross Package: gcc-5 Package: gcc-5-cross Package: gcc-5-cross-ports Package: gcc-6 Package: gcc-6-cross Package: gcc-6-cross-ports Package: gcc-7 Package: gcc-7-cross Package: gcc-7-cross-ports Package: gcc-8 Package: gcc-8-cross Package: gcc-8-cross-ports Package: gcc-9 Package: gcc-9-cross Package: gcc-9-cross-mipsen Package: gcc-9-cross-ports Package: gcc-arm-linux-androideabi Package: gcc-arm-none-eabi Package: gcc-avr Package: gcc-defaults Package: gcc-h8300-hms Package: gcc-i686-linux-android Package: gcc-m68hc1x Package: gcc-mingw-w64 Package: gcc-msp430 Package: gcc-or1k-elf Package: gcc-riscv64-unknown-elf Package: gcc-snapshot Package: gcc-xtensa-lx106 Package: gccgo-4.9 Package: gccgo-6 Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Hardened Images — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat OpenShift AI (RHOAI) — —
Red Hat Red Hat OpenShift Container Platform 4 — —
Red Hat Red Hat OpenShift Container Platform 5 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 gcc-12 +3 No fix yet —
Debian 14 gcc-14 14.4.0-4 —
Debian 13 gcc-12 +2 No fix yet —
Debian 12 gcc-11 +1 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 gcc-11 +16 No fix yet —
Ubuntu 26.04 LTS gcc-11 +16 No fix yet —
Ubuntu 24.04 LTS gcc-9 +27 No fix yet —
Ubuntu 22.04 LTS gcc-9 +25 No fix yet —
Ubuntu 20.04 LTS gcc-7 +19 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS gcc-5 +21 No fix yet —
Ubuntu 16.04 LTS gcc-3.3 +22 No fix yet —
Ubuntu 14.04 LTS gcc-3.3 +5 No fix yet —
Ubuntu Pro 20.04 LTS gcc-9 +2 No fix yet —
Ubuntu Pro 16.04 LTS gcc-5 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 cpp +30 14.4.1-5.el10_3 RHSA-2026:98648
RHEL 10 gcc-toolset-15-gcc +16 15.2.1-8.2.el10_3 RHSA-2026:98633
RHEL 10 libgdiagnostics +18 16.2.1-1.4.el10_3 RHSA-2026:98640
RHEL 9 cpp +27 11.5.0-17.el9_9 RHSA-2026:98534, RHSA-2026:98526, RHSA-2026:98524
RHEL 9 libasan8 +18 15.2.1-7.4.el9_9 RHSA-2026:98534, RHSA-2026:98526
RHEL 9 libgdiagnostics +18 16.2.1-1.4.el9_9 RHSA-2026:98534
RHEL 8 cpp +27 8.5.0-31.el8_10 RHSA-2026:99632, RHSA-2026:98115
RHEL 8 libasan8 +18 15.2.1-7.3.el8_10 RHSA-2026:99632
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 cpp +39 16.2.1-3.2.hum1 RHSA-2026:95581
Red Hat Hardened Images 1 gcc13 +3 13.5.0-0.5.hum1 RHSA-2026:95981

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 cpp +27 8.5.0-31.el8_10.alma.1 ALSA-2026:98115

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 cpp +30 14.4.1-5.el10_3 RLSA-2026:98648
Rocky Linux 10 gcc-toolset-15-gcc +16 15.2.1-8.2.el10_3 RLSA-2026:98633
Rocky Linux 9 cpp +27 11.5.0-17.el9_9 RLSA-2026:98534, RLSA-2026:98524
Rocky Linux 9 gcc-toolset-15-gcc +16 15.2.1-7.4.el9_9 RLSA-2026:98526
Rocky Linux 9 libasan8 +20 16.2.1-1.4.el9_9 RLSA-2026:98534
Rocky Linux 8 gcc 8.5.0-31.el8_10 RLSA-2026:98115
Rocky Linux 8 libasan8 +18 15.2.1-7.3.el8_10 RLSA-2026:99632

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed gcc13 13.5.0+git10516-3.1 openSUSE-SU-2026:12510-1
openSUSE Tumbleweed gcc14 14.4.0+git12698-2.1 openSUSE-SU-2026:12496-1
openSUSE Tumbleweed gcc15 15.3.0+git11272-4.1 openSUSE-SU-2026:12511-1
openSUSE Tumbleweed gcc16 16.2.1+git9901-1.1 openSUSE-SU-2026:12482-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gcc No fix yet —

Advisories 23

References