Live › vulnerability › CVE-2026-115456
A flaw in the libstdc++ library shipped with GCC lets an attacker pass a string that is not null-terminated to std::from_chars(). The out-of-bounds read can crash the application or cause it to parse invalid data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Applications compiled with GCC that call std::from_chars on input that may not be null-terminated are exposed to a crash. The sources do not list affected versions or whether a default configuration is at risk. Teams that do not call std::from_chars can likely skip it.
No product ranges from the sources yet.
gcc --version to see which GCC release the build usesstd::from_charsNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-115456")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.