---
id: CVE-2026-114691
title: 'Gcc: integer wrap in `std'
summary: >-
  A flaw was found in the libstdc++ component of GCC. An attacker who can
  provide an excessively large element count to a boolean vector
  (std::vector<bool>) constructor can trigger an integer wrap during internal
  memory calculations. This …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-190
vendor: Red Hat
product: gcc
affected:
  - gcc (all versions)
  - gcc-toolset-15-gcc (all versions)
  - gcc-toolset-16-gcc (all versions)
  - mingw-gcc (all versions)
  - compat-gcc-295
  - compat-gcc-296
  - compat-gcc-32
  - compat-gcc-34
  - gcc
  - compat-gcc-32
  - compat-gcc-34
  - compat-gcc-44
  - gcc
  - gcc (all versions)
  - gcc-toolset-14-gcc (all versions)
  - gcc-toolset-15-gcc (all versions)
  - mingw-gcc (all versions)
  - gcc (all versions)
  - gcc-toolset-14-gcc (all versions)
  - gcc-toolset-15-gcc (all versions)
  - gcc-toolset-16-gcc (all versions)
  - mingw-gcc (all versions)
  - gcc (all versions)
  - gcc13 (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T16:58:15.100212Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:34:30.487Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114691'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114691'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2478508'
    label: RHBZ#2478508
tags:
  - cve.org
epss: 0.00395
epssPercentile: 0.33852
ingestedAt: '2026-11-05T16:24:31.328Z'
---

## Overview

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.

## Affected

- `gcc (all versions)`
- `gcc-toolset-15-gcc (all versions)`
- `gcc-toolset-16-gcc (all versions)`
- `mingw-gcc (all versions)`
- `compat-gcc-295`
- `compat-gcc-296`
- `compat-gcc-32`
- `compat-gcc-34`
- `gcc`
- `compat-gcc-32`
- `compat-gcc-34`
- `compat-gcc-44`
- `gcc`
- `gcc (all versions)`
- `gcc-toolset-14-gcc (all versions)`
- `gcc-toolset-15-gcc (all versions)`
- `mingw-gcc (all versions)`
- `gcc (all versions)`
- `gcc-toolset-14-gcc (all versions)`
- `gcc-toolset-15-gcc (all versions)`
- `gcc-toolset-16-gcc (all versions)`
- `mingw-gcc (all versions)`
- `gcc (all versions)`
- `gcc13 (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.