CVE-2026-125709: Buffer Overflow
A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.
Other sources
Basically if an fstream bytewise write using stream->putc() fails due to an error (e.g. a transient disk failure or ENOSPCE), the operation ends up writing the char into the backing buffer anyway and multiple such operations could eventually result in writing arbitrary bytes beyond the backing buffer. Note that a typical stream write (i.e. stream << "foo" ) is not affected by this.
Requisites for an attack:
1. Ability to invoke a write failure by, e.g. chaining a different vulnerability that allows such access 2. Finding a target suid application or service that calls stream->putc() in a user-controlled path 3. Ability to already control the execution frequency of stream->putc() to cause a buffer overflow.
There are no suid applications that use this pattern AFAIK, so I don't think there's a local attack vector here at all, only a network one through a service. There's no confidentiality compromise either AFAICT, there's only a minor risk of data corruption and a small incremental (given the already compromised ability to invoke a storage failure) risk of DoS due to invoking a crash in the target service that meets all of the above criteria.
— Red Hat