CVE-2026-114690
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flaw was found in GCC: an out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to denial of service (DoS).
Risk Assessment
A local attacker could crash applications built with parallel mode, resulting in service unavailability.
Recommendation
Update GCC/libstdc++ to a patched version and rebuild applications using parallel mode; restrict the ability to supply untrusted search data to such applications.
Other vulnerabilities in GCC libstdc++
See all- CVE-2026-115456Low
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
- CVE-2026-115455Medium
A flaw was found in GCC libstdc++: when an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker able to supply crafted input to an affected application could trigger a stack-based buffer overflow leading to denial of service (DoS).
- CVE-2026-114691Medium
A flaw was found in the libstdc++ component of GCC: an attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or denial of service (DoS) during subsequent operations.
Original NVD description (English source)
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS