Out-of-bounds memory access in GCC libstdc++ parallel search
Priority LOW 26CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
The libstdc++ parallel search implementation in GCC contains an out-of-bounds memory access caused by an undersized internal buffer, classified as CWE-787. A local attacker can supply crafted search data to an application compiled with parallel mode, which crashes the process and causes a denial of service.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00107 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Hardened Images | — | — | No fix listed | CNA |
| Red Hat | Red Hat Hardened Images | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | No fix listed | CNA |
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:enterprise_linux:10 | 10 | — | Red Hat |
| cpe:/o:redhat:rhel_els:6 | 6 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8 | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9 | 9 | — | Red Hat |
| cpe:/a:redhat:hummingbird:1 | 1 | — | Red Hat |
| cpe:/a:redhat:openshift_ai | — | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift:5 | 5 | — | Red Hat |
- cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
- cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat
- cpe:/a:redhat:hummingbird:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:openshift_ai Versions — — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat
Remediation
Red Hat lists Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Hardened Images, Red Hat OpenShift AI and Red Hat OpenShift Container Platform 4 and 5 as affected without a fix, and its plan is none available for all of them except Red Hat OpenShift AI. The sources list no fixed version for GCC.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-30 Threatist record created from CVE-2026-114690
- 2026-10-30 Alias added: GHSA-36h8-gj54-w3vc
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-10-30 Affected versions changed · CNA
- 2026-10-31 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · CNA
- 2026-11-06 Affected versions changed · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-114690 · CVE Program
- CVE-2026-114690 · NVD
- FIRST EPSS
- GHSA-36h8-gj54-w3vc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-114690 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences