RLSA-2026:98534: Moderate: gcc-toolset-16-gcc security update

Published Nov 13, 2026
·
Updated

The gcc-toolset-16-gcc13 package contains the GNU Compiler Collection version 16.

Security Fix(es):

gcc: Integer wrap in std (CVE-2026-114691)

gcc: Confirmed out-of-bounds read/write in libstdc++ parallel std (CVE-2026-114690)

gcc: Stack overflow in std::bitset on libstdc++ (CVE-2026-115455)

gcc: Out-of-bounds read in std::fromchars (CVE-2026-115456)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

33 affected componentsFixes available
rocky-linux/gcc-toolset-16-gcc<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-c++<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-c++-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-gfortran<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-gfortran-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-plugin-annobin<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-plugin-annobin-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-plugin-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-gcc-plugin-devel-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libasan-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libatomic-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libgccjit<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libgccjit-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libgccjit-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libgdiagnostics-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libitm-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-liblsan-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libstdc++-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libstdc++-docs<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libtsan-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libubsan-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/libasan8<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/libasan8-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/libgdiagnostics<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/libgdiagnostics-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/libtsan2<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/libtsan2-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-libquadmath-devel<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-offload-nvptx<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/gcc-toolset-16-offload-nvptx-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/liblsan<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9
rocky-linux/liblsan-debuginfo<0:16.2.1-1.4.el9_9
0:16.2.1-1.4.el9_9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  2. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-c++ to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  3. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-c++-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  4. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  5. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-gfortran to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  6. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-gfortran-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  7. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-plugin-annobin to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  8. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-plugin-annobin-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  9. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-plugin-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  10. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-gcc-plugin-devel-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  11. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libasan-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  12. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libatomic-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  13. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libgccjit to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  14. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libgccjit-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  15. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libgccjit-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  16. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libgdiagnostics-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  17. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libitm-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  18. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-liblsan-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  19. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libstdc++-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  20. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libstdc++-docs to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  21. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libtsan-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  22. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libubsan-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  23. Upgrade

    Upgrade rocky-linux/libasan8 to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  24. Upgrade

    Upgrade rocky-linux/libasan8-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  25. Upgrade

    Upgrade rocky-linux/libgdiagnostics to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  26. Upgrade

    Upgrade rocky-linux/libgdiagnostics-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  27. Upgrade

    Upgrade rocky-linux/libtsan2 to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  28. Upgrade

    Upgrade rocky-linux/libtsan2-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  29. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-libquadmath-devel to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  30. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-offload-nvptx to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  31. Upgrade

    Upgrade rocky-linux/gcc-toolset-16-offload-nvptx-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  32. Upgrade

    Upgrade rocky-linux/liblsan to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9
  33. Upgrade

    Upgrade rocky-linux/liblsan-debuginfo to a version that resolves this vulnerability.

    Fixed in 0:16.2.1-1.4.el9_9

Event History

Nov 13, 2026
Advisory Published
via OSV·12:04 PM
Data Sourced
via OSV·12:04 PM
DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Which components are implicated by this update?

The advisory identifies flaws in GCC's libstdc++ functionality, including parallel standard-library operations, std::bitset, and std::from_chars, as well as an integer-wrap issue in std. The listed packages include the GCC, C++, GFortran, debuginfo, and annobin plugin variants in gcc-toolset-16.

2

What impact is identified for the reported flaws?

The listed issues include an integer wrap, confirmed out-of-bounds read/write, stack overflow, and out-of-bounds read. The advisory rates the update medium severity with a CVSS vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203