CVE Alert: CVE-2026-102010 – Red Hat

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

**Risk verdict:** Prioritise assessment and remediation for internet-reachable applications that use the affected library; active exploitation and exploitation-likelihood indicators are not provided, so urgency cannot be raised on that basis.

**Why this matters:** A remote attacker may be able to crash a service that reaches the vulnerable operation, causing outages; memory corruption is also possible, though the supplied impact assessment does not establish reliable code execution. The practical risk depends on whether an exposed application processes attacker-controlled input in a way that triggers this specific operation.

**Most likely attack path:** Network access is sufficient in principle, with no account or user action required, but high attack complexity means the necessary application behaviour may be uncommon or difficult to induce. Scope is unchanged, so impact is expected within the affected process rather than automatically enabling movement into other systems.

**Who is most exposed:** Prioritise externally accessible services and container workloads built or run with the affected C++ runtime, especially those processing untrusted data. Presence of compiler packages alone does not confirm that a vulnerable service is exposed.

Correlate service crashes or restarts with requests that exercise priority-queue processing.

Review core dumps and logs for invalid or freed-memory access in relevant processes.

Inventory deployed binaries and runtime libraries, not just build hosts.

Mitigation and prioritisation

Apply the vendor’s fixed package update when available; verify the fix for each supported platform.

Identify and rebuild or redeploy affected applications where required.

Until patched, constrain access to exposed services and validate or limit untrusted inputs.

Test changes in staging; confirm runtime library updates reach containers and production hosts.

KEV, SSVC, PoC and EPSS data are absent; obtain these indicators before finalising urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.