A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.9 · red hatNVD modified 2026-10-30 07:13
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 2
- https://access.redhat.com/security/cve/CVE-2026-114691 vdb-entry, x_refsource_redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2478508 issue-tracking, x_refsource_redhat