A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

Applications can mitigate this issue by avoiding calls to erase_if() on __gnu_pbds::priority_queue containers that use the binary_heap_tag backend. Where predicate-based removal is required, use an alternative container or a different heap backend in application code. Apart from applying a fixed package when one becomes available, no other mitigation is currently available.

History

Wed, 11 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.8::appstream
cpe:/a:redhat:rhel_eus:9.8::crb
cpe:/o:redhat:enterprise_linux_eus:10.2
cpe:/o:redhat:rhel_eus:9.8::baseos
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Eus
References

Wed, 11 Nov 2026 13:15:00 +0000

Type Values Removed Values Added
References

Wed, 11 Nov 2026 12:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
References

Wed, 11 Nov 2026 12:00:00 +0000

Type Values Removed Values Added
References

Wed, 11 Nov 2026 11:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.3
References

Fri, 06 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Ai
CPEs cpe:/a:redhat:openshift_ai
Vendors & Products Redhat openshift Ai
References

Thu, 05 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:10
cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els

Fri, 30 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5

Thu, 29 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.2
References

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
References

Fri, 02 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
References

Wed, 30 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
References

Tue, 29 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu gcc
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Gnu
Gnu gcc
Redhat hardened Images
Redhat openshift Container Platform

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Moderate


Mon, 28 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 28 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825

Mon, 28 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
Title Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-11T19:17:05.819Z

Reserved: 2026-09-28T17:33:28.667Z

Link: CVE-2026-102010

cve-icon Vulnrichment

Updated: 2026-09-28T20:53:16.730Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T19:16:48.830

Modified: 2026-11-11T20:17:04.977

Link: CVE-2026-102010

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-28T17:44:00Z

Links: CVE-2026-102010 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T13:20:25Z

Weaknesses