{"id":"CVE-2026-114691","title":"Gcc: integer wrap in `std","summary":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"Red Hat","product":"gcc","affected":["gcc (all versions)","gcc-toolset-15-gcc (all versions)","gcc-toolset-16-gcc (all versions)","mingw-gcc (all versions)","compat-gcc-295","compat-gcc-296","compat-gcc-32","compat-gcc-34","gcc","compat-gcc-32","compat-gcc-34","compat-gcc-44","gcc","gcc (all versions)","gcc-toolset-14-gcc (all versions)","gcc-toolset-15-gcc (all versions)","mingw-gcc (all versions)","gcc (all versions)","gcc-toolset-14-gcc (all versions)","gcc-toolset-15-gcc (all versions)","gcc-toolset-16-gcc (all versions)","mingw-gcc (all versions)","gcc (all versions)","gcc13 (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:58:15.100212Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T18:34:30.487Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114691","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-114691"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478508","label":"RHBZ#2478508"}],"tags":["cve.org"],"epss":0.00395,"epssPercentile":0.33852,"ingestedAt":"2026-11-05T16:24:31.328Z","slug":"CVE-2026-114691","body":"## Overview\n\nA flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.\n\n## Affected\n\n- `gcc (all versions)`\n- `gcc-toolset-15-gcc (all versions)`\n- `gcc-toolset-16-gcc (all versions)`\n- `mingw-gcc (all versions)`\n- `compat-gcc-295`\n- `compat-gcc-296`\n- `compat-gcc-32`\n- `compat-gcc-34`\n- `gcc`\n- `compat-gcc-32`\n- `compat-gcc-34`\n- `compat-gcc-44`\n- `gcc`\n- `gcc (all versions)`\n- `gcc-toolset-14-gcc (all versions)`\n- `gcc-toolset-15-gcc (all versions)`\n- `mingw-gcc (all versions)`\n- `gcc (all versions)`\n- `gcc-toolset-14-gcc (all versions)`\n- `gcc-toolset-15-gcc (all versions)`\n- `gcc-toolset-16-gcc (all versions)`\n- `mingw-gcc (all versions)`\n- `gcc (all versions)`\n- `gcc13 (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}