---
id: CVE-2026-114690
title: 'Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std'
summary: >-
  A flaw was found in GCC. An out-of-bounds memory access vulnerability exists
  in the libstdc++ parallel search implementation due to an undersized internal
  buffer. A local attacker can exploit this flaw by providing crafted search
  data to…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: gcc
affected:
  - gcc (all versions)
  - gcc-toolset-15-gcc (all versions)
  - gcc-toolset-16-gcc (all versions)
  - mingw-gcc (all versions)
  - compat-gcc-295
  - compat-gcc-296
  - compat-gcc-32
  - compat-gcc-34
  - gcc
  - compat-gcc-32
  - compat-gcc-34
  - compat-gcc-44
  - gcc
  - gcc (all versions)
  - gcc-toolset-14-gcc (all versions)
  - gcc-toolset-15-gcc (all versions)
  - mingw-gcc (all versions)
  - gcc (all versions)
  - gcc-toolset-14-gcc (all versions)
  - gcc-toolset-15-gcc (all versions)
  - gcc-toolset-16-gcc (all versions)
  - mingw-gcc (all versions)
  - gcc (all versions)
  - gcc13 (all versions)
  - rhoai/odh-ai-gateway-operator-rhel9
  - rhoai/odh-core-bff-rhel9
  - rhoai/odh-dashboard-operator-rhel9
  - rhoai/odh-dashboard-rhel9
  - rhoai/odh-data-science-pipelines-operator-controller-rhel9
  - rhoai/odh-kf-notebook-controller-rhel9
  - rhoai/odh-kserve-controller-rhel9
  - rhoai/odh-kserve-llmisvc-controller-rhel9
  - rhoai/odh-kserve-module-operator-rhel9
  - rhoai/odh-kuberay-operator-controller-rhel9
  - rhoai/odh-kube-rbac-proxy-rhel9
  - rhoai/odh-llama-stack-k8s-operator-rhel9
  - rhoai/odh-maas-controller-rhel9
  - rhoai/odh-mlflow-operator-rhel9
  - rhoai/odh-mlflow-rhel9
  - rhoai/odh-mod-arch-agent-ops-rhel9
  - rhoai/odh-mod-arch-automl-rhel9
  - rhoai/odh-mod-arch-autorag-rhel9
  - rhoai/odh-mod-arch-eval-hub-rhel9
  - rhoai/odh-mod-arch-gen-ai-rhel9
  - rhoai/odh-mod-arch-maas-rhel9
  - rhoai/odh-mod-arch-mlflow-rhel9
  - rhoai/odh-mod-arch-model-registry-rhel9
  - rhoai/odh-model-controller-rhel9
  - rhoai/odh-model-registry-operator-rhel9
  - rhoai/odh-model-serving-api-rhel9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:20:50.353340Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T07:40:07.638Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114690'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114690'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2478652'
    label: RHBZ#2478652
tags:
  - cve.org
epss: 0.00107
epssPercentile: 0.0114
ingestedAt: '2026-11-05T16:24:31.361Z'
---

## Overview

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

## Affected

- `gcc (all versions)`
- `gcc-toolset-15-gcc (all versions)`
- `gcc-toolset-16-gcc (all versions)`
- `mingw-gcc (all versions)`
- `compat-gcc-295`
- `compat-gcc-296`
- `compat-gcc-32`
- `compat-gcc-34`
- `gcc`
- `compat-gcc-32`
- `compat-gcc-34`
- `compat-gcc-44`
- `gcc`
- `gcc (all versions)`
- `gcc-toolset-14-gcc (all versions)`
- `gcc-toolset-15-gcc (all versions)`
- `mingw-gcc (all versions)`
- `gcc (all versions)`
- `gcc-toolset-14-gcc (all versions)`
- `gcc-toolset-15-gcc (all versions)`
- `gcc-toolset-16-gcc (all versions)`
- `mingw-gcc (all versions)`
- `gcc (all versions)`
- `gcc13 (all versions)`
- `rhoai/odh-ai-gateway-operator-rhel9`
- `rhoai/odh-core-bff-rhel9`
- `rhoai/odh-dashboard-operator-rhel9`
- `rhoai/odh-dashboard-rhel9`
- `rhoai/odh-data-science-pipelines-operator-controller-rhel9`
- `rhoai/odh-kf-notebook-controller-rhel9`
- `rhoai/odh-kserve-controller-rhel9`
- `rhoai/odh-kserve-llmisvc-controller-rhel9`
- `rhoai/odh-kserve-module-operator-rhel9`
- `rhoai/odh-kuberay-operator-controller-rhel9`
- `rhoai/odh-kube-rbac-proxy-rhel9`
- `rhoai/odh-llama-stack-k8s-operator-rhel9`
- `rhoai/odh-maas-controller-rhel9`
- `rhoai/odh-mlflow-operator-rhel9`
- `rhoai/odh-mlflow-rhel9`
- `rhoai/odh-mod-arch-agent-ops-rhel9`
- `rhoai/odh-mod-arch-automl-rhel9`
- `rhoai/odh-mod-arch-autorag-rhel9`
- `rhoai/odh-mod-arch-eval-hub-rhel9`
- `rhoai/odh-mod-arch-gen-ai-rhel9`
- `rhoai/odh-mod-arch-maas-rhel9`
- `rhoai/odh-mod-arch-mlflow-rhel9`
- `rhoai/odh-mod-arch-model-registry-rhel9`
- `rhoai/odh-model-controller-rhel9`
- `rhoai/odh-model-registry-operator-rhel9`
- `rhoai/odh-model-serving-api-rhel9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.