{"id":"CVE-2026-115456","kind":"vulnerability","aliases":["CVE-2026-115456"],"related":[],"title":"GCC libstdc++: non-terminated string to from_chars crashes applications","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.","summary":"A flaw in the libstdc++ library shipped with GCC lets an attacker pass a string that is not null-terminated to std::from_chars(). The out-of-bounds read can crash the application or cause it to parse invalid data.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","gcc","libstdc++","runtime"],"not_affected_if":["no-from-chars-calls"],"how_to_check":"- `gcc --version` to see which GCC release the build uses\n- Search your code and dependencies for calls to `std::from_chars`","fix":null,"status":"open","published_at":"2026-10-30T09:17:14+00:00","first_seen_at":"2026-10-30T09:29:38+00:00","triaged_at":"2026-10-30T09:30:40+00:00","updated_at":"2026-10-30T09:30:40+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-30T09:30:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GCC libstdc++: non-terminated string to from_chars crashes applications","impact":"low","summary":"A flaw in the libstdc++ library shipped with GCC lets an attacker pass a string that is not null-terminated to std::from_chars(). The out-of-bounds read can crash the application or cause it to parse invalid data.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["gcc","c++","libstdc++"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"application crashes or parses invalid data","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115456 for affected GCC versions and whether a patched release exists.","how_to_check":"- `gcc --version` to see which GCC release the build uses\n- Search your code and dependencies for calls to `std::from_chars`\n- unknown for the exact affected versions, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-from-chars-calls"],"who_is_affected":"Applications compiled with GCC that call std::from_chars on input that may not be null-terminated are exposed to a crash. The sources do not list affected versions or whether a default configuration is at risk. Teams that do not call std::from_chars can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000672,"input_tokens":4105,"output_tokens":523,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115456':14A,17A '-2026':13A,16A 'alloc':110C 'applic':11A,56B,120C 'attack':33B,71C 'beyond':108C 'bound':51B,106C 'buffer':111C 'c':18B 'caus':58B,73C 'char':9A,46B,93C 'could':72C 'crash':10A,54B,121C 'cve':12A,15A 'data':63B,116C 'denial':75C 'dos':78C 'flaw':23B,65C 'found':67C 'function':94C 'gcc':1A,19B,30B,69C 'invalid':62B,115C 'issu':100C 'lead':113C 'let':31B 'librari':27B,98C 'libstdc':2A,20B,26B,97C 'non':4A 'non-termin':3A 'null':41B,87C 'null-termin':40B,86C 'out-of-bound':48B,103C 'pars':61B,117C 'pass':34B,80C 'potenti':112C 'read':52B,107C 'runtim':21B 'servic':77C 'ship':28B 'std':44B,91C 'string':6A,36B,82C 'termin':5A,42B,88C 'trigger':101C","nicknames":[],"mitigations":[],"who_affected":"Applications compiled with GCC that call std::from_chars on input that may not be null-terminated are exposed to a crash. The sources do not list affected versions or whether a default configuration is at risk. Teams that do not call std::from_chars can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","severity":null,"published_at":"2026-10-30T09:17:14+00:00","modified_at":"2026-10-30T09:17:14+00:00","first_seen_at":"2026-10-30T09:29:38+00:00","fetched_at":"2026-10-30T09:29:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}