CVE-2026-95619: Gcc: libstd++: libstdc++ integer overflow in `new` operator
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the C++ new operator. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.
Other sources
An integer overflow triggered when processing inputs to the C++ new operator in libstdc+-v3/libsupc+/newopa.cc where sz + align could overflow with large sz or align, potentially resulting in an undersized allocation instead of throwing badalloc. Note that this only affects older gcc versions since 12.4 onwards (see pr113258) prefer posixmemalign over alignedalloc so on the RHEL front this should only affect RHEL9 and RHEL8 system gcc. The older libstdc++ (8.5.0) has a slightly different variant of that expression but has the same overflow problem.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prefer POSIX `posix_memalign` over `aligned_alloc` when allocating aligned memory.
Event History
Frequently Asked Questions
Which systems are specifically identified as affected?
The issue is identified as affecting older GCC versions, with the RHEL impact described as RHEL 8 and RHEL 9 system GCC. libstdc++ 8.5.0 is also noted to contain a slightly different expression with the same overflow problem.
What does an attacker need to do to trigger the flaw?
The flaw requires processing very large size or alignment values through the C++ new operator so that the sz + align calculation overflows. The supplied data does not identify any required authentication or user interaction.
What is the likely impact if exploitation succeeds?
An overflow can produce an undersized allocation rather than a bad_alloc error. This can lead to memory corruption or application instability, with high integrity and availability impact and low confidentiality impact in the supplied severity vector.
How can I determine whether my application may be exposed?
Review whether the application uses the affected libstdc++ runtime and can pass attacker-controlled or otherwise extremely large allocation sizes or alignment values to C++ new operations. Systems using RHEL 8 or RHEL 9 system GCC are specifically called out as affected on the RHEL front.