Skip to content
OpenAdvisories
Medium · 4.2 CVE-2026-125709 EUVD-2026-120884GHSA-grvf-fp92-82c6

Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

Published Nov 10, 2026 · Updated Nov 14, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Enterprise Linux 10 Product: Red Hat Enterprise Linux 6 Product: Red Hat Enterprise Linux 7 Product: Red Hat Enterprise Linux 8 Product: Red Hat Enterprise Linux 9 Product: Red Hat Hardened Images Product: Red Hat OpenShift Container Platform 4 Product: Red Hat OpenShift Container Platform 5 Package: gcc Package: gcc-10 Package: gcc-10-cross Package: gcc-10-cross-mipsen Package: gcc-10-cross-ports Package: gcc-11 Package: gcc-11-cross Package: gcc-11-cross-mipsen Package: gcc-11-cross-ports Package: gcc-12 Package: gcc-12-cross Package: gcc-12-cross-mipsen Package: gcc-12-cross-ports Package: gcc-13 Package: gcc-13-cross Package: gcc-13-cross-ports Package: gcc-3.3 Package: gcc-4.7 Package: gcc-4.7-armel-cross Package: gcc-4.7-armhf-cross Package: gcc-4.8 Package: gcc-4.8-arm64-cross Package: gcc-4.8-armhf-cross Package: gcc-4.8-powerpc-cross Package: gcc-4.8-ppc64el-cross Package: gcc-4.9 Package: gcc-4.9-cross Package: gcc-5 Package: gcc-5-cross Package: gcc-5-cross-ports Package: gcc-6 Package: gcc-6-cross Package: gcc-6-cross-ports Package: gcc-7 Package: gcc-7-cross Package: gcc-7-cross-ports Package: gcc-8 Package: gcc-8-cross Package: gcc-8-cross-ports Package: gcc-9 Package: gcc-9-cross Package: gcc-9-cross-mipsen Package: gcc-9-cross-ports Package: gcc-arm-linux-androideabi Package: gcc-arm-none-eabi Package: gcc-avr Package: gcc-defaults Package: gcc-h8300-hms Package: gcc-i686-linux-android Package: gcc-m68hc1x Package: gcc-mingw-w64 Package: gcc-msp430 Package: gcc-or1k-elf Package: gcc-riscv64-unknown-elf Package: gcc-snapshot Package: gcc-xtensa-lx106 Package: gccgo-4.9 Package: gccgo-6 Platform: Linux Ecosystem: Azure Linux Ecosystem: Ubuntu

Description

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Hardened Images — —
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat OpenShift Container Platform 4 — —
Red Hat Red Hat OpenShift Container Platform 5 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 gcc-11 +16 No fix yet —
Ubuntu 26.04 LTS gcc-11 +16 No fix yet —
Ubuntu 24.04 LTS gcc-9 +27 No fix yet —
Ubuntu 22.04 LTS gcc-9 +25 No fix yet —
Ubuntu 20.04 LTS gcc-7 +19 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS gcc-5 +21 No fix yet —
Ubuntu 16.04 LTS gcc-3.3 +22 No fix yet —
Ubuntu 14.04 LTS gcc-3.3 +5 No fix yet —
Ubuntu Pro 20.04 LTS gcc-9 +2 No fix yet —
Ubuntu Pro 16.04 LTS gcc-5 +1 No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gcc No fix yet —

References