Heap-based Buffer Overflow in GCC libstdc++ std::from_chars

Executive Summary

CVE-2026-115456 is a flaw in the GCC compiler's libstdc++ library affecting the std::from_chars() function. When a non-null-terminated string is passed to this function, it triggers an out-of-bounds read. This can cause applications to crash or parse incorrect floating-point data, leading to a Denial of Service (DoS) condition.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of GCC or libstdc++. Use commands like 'gcc --version' or 'rpm -q gcc' to identify installed versions. Scan for applications using std::from_chars() with tools like 'grep' or 'objdump' to find potential vulnerable binaries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could impact you if you use applications compiled with affected GCC versions that process untrusted input. An attacker could exploit it to crash your application or cause incorrect data processing. However, exploitation requires specific conditions like passing non-null-terminated strings, making real-world impact limited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves upgrading to patched versions of GCC or libstdc++ if available. Avoid passing non-null-terminated strings to std::from_chars(). Monitor applications for crashes or data parsing errors. Consult vendor documentation for specific patches or workarounds.

Useful 0 Not Useful 0