{"id":"CVE-2026-125709","kind":"vulnerability","aliases":["CVE-2026-125709"],"related":[],"title":"libstdc++: failed file writes can overflow a buffer, causing crash or memory corruption","description":"A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.","summary":"When a byte-by-byte write to a file stream fails, libstdc++ may still append the data to its internal buffer. An attacker who can force repeated write failures in an affected service can trigger a buffer overflow, leading to denial of service or memory corruption.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","gcc","libstdc++","runtime"],"not_affected_if":["no-file-stream-writes"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:48+00:00","updated_at":"2026-11-10T12:22:48+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T12:22:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"libstdc++: failed file writes can overflow a buffer, causing crash or memory corruption","impact":"medium","summary":"When a byte-by-byte write to a file stream fails, libstdc++ may still append the data to its internal buffer. An attacker who can force repeated write failures in an affected service can trigger a buffer overflow, leading to denial of service or memory corruption.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["c++","libstdc++","gcc"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Service crashes or memory is corrupted after repeated write failures","analyst_note":"Check the GCC bug tracker and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125709 for affected and fixed GCC versions and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-file-stream-writes"],"who_is_affected":"Services built with libstdc++ that write to file streams and can be made to hit repeated write failures, for example when disk space runs out or a file descriptor is closed. Programs that do not write through file streams, or that cannot be driven into repeated write failures, are less exposed. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4537,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125709':16A,19A '-2026':15A,18A 'affect':56B,111C 'append':39B,94C 'attack':47B,102C 'buffer':8A,45B,61B,100C,116C 'byte':27B,29B,80C,82C 'byte-by-byt':26B,79C 'c':20B 'capabl':103C 'caus':9A 'corrupt':13A,70B,128C 'crash':10A 'cve':14A,17A 'data':41B,95C 'denial':65B,122C 'dos':125C 'fail':2A,35B,85C 'failur':53B,108C 'file':3A,33B,87C 'flaw':72C 'forc':50B 'found':74C 'gcc':21B 'induc':105C 'intern':44B,98C 'lead':63B 'librari':91C 'libstdc':1A,22B,36B,76C 'may':37B,92C 'memori':12A,69B,99C,127C 'oper':84C 'overflow':6A,62B,117C 'potenti':118C 'process':89C 'repeat':51B,106C 'result':119C 'runtim':23B 'servic':57B,67B,112C,124C 'still':38B,93C 'stream':34B,88C 'trigger':59B,114C 'write':4A,30B,52B,83C,107C","nicknames":[],"mitigations":[],"who_affected":"Services built with libstdc++ that write to file streams and can be made to hit repeated write failures, for example when disk space runs out or a file descriptor is closed. Programs that do not write through file streams, or that cannot be driven into repeated write failures, are less exposed. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","gcc","libstdc","medium","runtime"],"campaign_type":null,"search_a":"'-125709':16A,19A '-2026':15A,18A 'buffer':8A 'caus':9A 'corrupt':13A 'crash':10A 'cve':14A,17A 'fail':2A 'file':3A 'libstdc':1A 'memori':12A 'overflow':6A 'write':4A","search_b":"'affect':56B 'append':39B 'attack':47B 'buffer':45B,61B 'byte':27B,29B 'byte-by-byt':26B 'c':20B 'corrupt':70B 'data':41B 'denial':65B 'fail':35B 'failur':53B 'file':33B 'forc':50B 'gcc':21B 'intern':44B 'lead':63B 'libstdc':22B,36B 'may':37B 'memori':69B 'overflow':62B 'repeat':51B 'runtim':23B 'servic':57B,67B 'still':38B 'stream':34B 'trigger':59B 'write':30B,52B","search_c":"'affect':111C 'append':94C 'attack':102C 'buffer':100C,116C 'byte':80C,82C 'byte-by-byt':79C 'capabl':103C 'corrupt':128C 'data':95C 'denial':122C 'dos':125C 'fail':85C 'failur':108C 'file':87C 'flaw':72C 'found':74C 'induc':105C 'intern':98C 'librari':91C 'libstdc':76C 'may':92C 'memori':99C,127C 'oper':84C 'overflow':117C 'potenti':118C 'process':89C 'repeat':106C 'result':119C 'servic':112C,124C 'still':93C 'stream':88C 'trigger':114C 'write':83C,107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125709","severity":null,"published_at":"2026-11-10T12:17:18+00:00","modified_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}