CVE-2026-102010
Description
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Statement
A moderate-impact use-after-free flaw was found in the libstdc++ pb_ds binary heap implementation of the GNU Compiler Collection (GCC), affecting the gcc, gcc-toolset-15-gcc, and mingw-gcc components in Red Hat Enterprise Linux 10 and products that build on RHEL components, including OpenShift Container Platform RHEL CoreOS images and Red Hat hardened images, as well as Fedora community packages. When an application calls the erase_if() member function on a __gnu_pbds::priority_queue that uses the binary_heap_tag backend, the library reallocates the internal entry array but fails to update the m_a_entries pointer. Subsequent heap operations, such as make_heap(), then operate on the freed storage, and object teardown may free the stale pointer again, resulting in heap memory corruption that can crash or destabilize the affected application (denial of service) or cause other in-process memory corruption. Exploitation requires an application to specifically use the non-default pb_ds binary_heap_tag container type and invoke erase_if() on it; no default or remotely reachable vulnerable path is known in the shipped packages. Although the CVSS:3.1 base score for this flaw is 7.0, Red Hat rates its impact as Moderate because of this narrow, opt-in reachability, and a fix is being pursued for the affected products.
Mitigation
Applications can mitigate this issue by avoiding calls to erase_if() on __gnu_pbds::priority_queue containers that use the binary_heap_tag backend. Where predicate-based removal is required, use an alternative container or a different heap backend in application code. Apart from applying a fixed package when one becomes available, no other mitigation is currently available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Acknowledgements
This issue was discovered by Found by AISLE in partnership with Red Hat.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
