CVE-2026-114690
Awaiting Analysis Awaiting Analysis - Queue

GCC Parallel Search Buffer Overflow Leads to DoS

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: redhat-SADP

Description
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-114690
EUVD
EUVD-2026-113745

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114690 is an out-of-bounds memory access flaw in GCC's libstdc++ parallel search implementation. It occurs in the parallel Knuth-Morris-Pratt search algorithm due to an undersized internal buffer in the _calc_borders() function. When a full match is found, the jump logic reads an out-of-bounds index, causing crashes or memory-safety failures. Exploitation requires crafted search data, parallel mode compilation, and specific conditions like pattern length greater than 1.

Detection Guidance

Detection requires checking if applications are compiled with libstdc++ parallel mode and OpenMP. Inspect build flags for _GLIBCXX_PARALLEL and OpenMP usage. Examine source code for parallel std::search calls. No direct network detection commands are available.

Impact Analysis

This vulnerability can cause Denial of Service (DoS) by crashing processes using parallel std::search in libstdc++. It requires specific compilation flags and conditions, limiting impact to applications built with parallel mode. Standard builds are unaffected. Exploitation depends on attacker-controlled search data triggering a full match.

Mitigation Strategies

Rebuild affected applications without parallel-mode extensions (_GLIBCXX_PARALLEL) or disable parallel std::search. Avoid compiling untrusted data paths with parallel mode. Monitor for crashes in applications using libstdc++ parallel search.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart