CVE-2026-102010
HighCVSS 7.0Summary
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Risk Assessment
The risk includes the possibility of causing application crashes or memory corruption, potentially leading to service unavailability. An attacker could exploit this vulnerability to perform a DoS attack.
Recommendation
Update GCC to a patched version and monitor applications using libstdc++ for unusual behavior.
Other vulnerabilities in GCC
See all- CVE-2019-15847High
In the POWER9 backend of GCC before version 10, optimization of multiple calls to the __builtin_darn intrinsic into a single call reduces the entropy of the random number generator. This occurs because a volatile operation was not specified.
- CVE-1999-1439Low
Gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files.
Original NVD description (English source)
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS