CVE-2026-102010

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Published Sep 28, 2026 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Description
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

Remediation

Vendor Workaround

Applications can mitigate this issue by avoiding calls to erase_if() on __gnu_pbds::priority_queue containers that use the binary_heap_tag backend. Where predicate-based removal is required, use an alternative container or a different heap backend in application code. Apart from applying a fixed package when one becomes available, no other mitigation is currently available.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.8::appstream
cpe:/a:redhat:rhel_eus:9.8::crb
cpe:/o:redhat:enterprise_linux_eus:10.2
cpe:/o:redhat:rhel_eus:9.8::baseos
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Eus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.3
References
Type Values Removed Values Added
First Time appeared Redhat openshift Ai
CPEs cpe:/a:redhat:openshift_ai
Vendors & Products Redhat openshift Ai
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:10
cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
References
Type Values Removed Values Added
First Time appeared Gnu
Gnu gcc
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Gnu
Gnu gcc
Redhat hardened Images
Redhat openshift Container Platform
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-825
Type Values Removed Values Added
Description A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Title Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}