CVE-2026-114691
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in the libstdc++ component of GCC: an attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or denial of service (DoS) during subsequent operations.
Risk Assessment
Applications using std::vector<bool> that accept element counts from users could be crashed, causing service unavailability.
Recommendation
Update GCC/libstdc++ to a patched version and rebuild affected applications; additionally validate input sizes passed to container constructors.
Other vulnerabilities in GCC libstdc++
See all- CVE-2026-115456Low
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
- CVE-2026-115455Medium
A flaw was found in GCC libstdc++: when an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker able to supply crafted input to an affected application could trigger a stack-based buffer overflow leading to denial of service (DoS).
- CVE-2026-114690Medium
A flaw was found in GCC: an out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to denial of service (DoS).
Original NVD description (English source)
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS