Skip to content
Fencer Vulns
high 7.0

CVE-2026-102010 json

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

published 2026-09-28 41 d ago modified 2026-11-07 2 d ago also EUVD-2026-88443

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:15.2.1-7.1.el10_2
  • Red Hat Red Hat Enterprise Linux 8 0:8.5.0-30.el8_10, 0:15.2.1-7.2.el8_10
  • Red Hat Red Hat Hardened Images 13.5.0-0.2.hum1, 16.2.1-3.2.hum1, 16.2.1-3.hum1
  • gcc-12 Debian 14 12.5.0-11
  • gcc-13 Debian 14 13.5.0-2
  • gcc-14 Debian 14 14.4.0-3
  • gcc-15 Debian 14 15.3.0-5
  • gcc-16 Debian 14 16.2.0-4

debian advisories DEBIAN-CVE-2026-102010

  • cpp hummingbird 1 16.2.1-3.hum1
  • gcc hummingbird 1 16.2.1-3.hum1
  • libgcc hummingbird 1 16.2.1-3.hum1
  • libitm hummingbird 1 16.2.1-3.hum1
  • gcc-c++ hummingbird 1 16.2.1-3.hum1
  • libasan hummingbird 1 16.2.1-3.hum1
  • libgomp hummingbird 1 16.2.1-3.hum1
  • liblsan hummingbird 1 16.2.1-3.hum1

red hat advisories RHSA-2026:74569RHSA-2026:73642

  • gcc7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 7.5.0+r278197-150000.4.49.1
  • cross-nvptx-gcc7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 7.5.0+r278197-150000.4.49.1
  • gcc13 Linux Micro 6.0 13.5.0+git10516-159998.1.1
  • gcc13 SLES 16.0, Linux Micro Extras 6.2, Linux Micro 6.2 +1 more 13.5.0+git10516-160000.1.1
  • gcc48 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 4.8.5-31.32.1

suse advisories SUSE-SU-2026:4637-1SUSE-SU-2026:4637-2SUSE-SU-2026:4913-1SUSE-SU-2026:24367-1SUSE-SU-2026:24129-1SUSE-SU-2026:24227-1

  • gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • cross-arm-gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • cross-bpf-gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • cross-nvptx-gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • cross-ppc64-gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • gcc13-testresults openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • cross-amdgcn-gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1
  • cross-x86_64-gcc13 openSUSE Leap 16.0 13.5.0+git10516-160000.1.1

opensuse advisories openSUSE-SU-2026:22083-1openSUSE-SU-2026:12081-1openSUSE-SU-2026:11982-1openSUSE-SU-2026:11941-1openSUSE-SU-2026:11942-1

  • gcc-toolset-15-gcc AlmaLinux 8 15.2.1-7.2.el8_10
  • liblsan AlmaLinux 8 15.2.1-7.2.el8_10
  • libasan8 AlmaLinux 8 15.2.1-7.2.el8_10
  • libtsan2 AlmaLinux 8 15.2.1-7.2.el8_10
  • gcc-toolset-15-gcc-c++ AlmaLinux 8 15.2.1-7.2.el8_10
  • gcc-toolset-15-libgccjit AlmaLinux 8 15.2.1-7.2.el8_10
  • gcc-toolset-15-gcc-gfortran AlmaLinux 8 15.2.1-7.2.el8_10
  • gcc-toolset-15-offload-nvptx AlmaLinux 8 15.2.1-7.2.el8_10

almalinux advisories ALSA-2026:90915ALSA-2026:89830ALSA-2026:89891

  • gcc-toolset-15-gcc Rocky Linux 10 15.2.1-7.1.el10_2
  • gcc-toolset-15-gcc Rocky Linux 8 15.2.1-7.2.el8_10
  • gcc Rocky Linux 8 8.5.0-30.el8_10

rocky linux advisories RLSA-2026:89891RLSA-2026:90915RLSA-2026:89830

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-102010 updated cvss 7.0

gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if

  • Red Hat Enterprise Linux 6 cpp, gcc, libgcc, libgcj, libitm, gcc-c++, +23 more Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, libgcc, libitm, +20 more Red Hat Enterprise Linux 8 stress-ng, mingw32-cpp, mingw32-gcc, mingw64-cpp, mingw64-gcc, rteval-loads, +2 more Red Hat Enterprise Linux 9 cpp, gcc, libgcc, libitm, gcc-c++, libasan, +39 more Red Hat Enterprise Linux 10 gcc, mingw-gcc, mingw32-gcc, mingw64-gcc, gcc-toolset-16-gcc Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9
    +1 more products
    Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Enterprise Linux AppStream (v. 8) cpp 8.5.0-30.el8_10, gcc 8.5.0-30.el8_10, gcc-c++ 8.5.0-30.el8_10, liblsan 15.2.1-7.2.el8_10, libasan8 15.2.1-7.2.el8_10, libtsan2 15.2.1-7.2.el8_10, +10 more
    fixed: vendor fix RHSA-2026:89830
  • Red Hat Enterprise Linux AppStream (v. 10) gcc-toolset-15-gcc 15.2.1-7.1.el10_2, gcc-toolset-15-gcc-c++ 15.2.1-7.1.el10_2, gcc-toolset-15-libgccjit 15.2.1-7.1.el10_2, gcc-toolset-15-gcc-gfortran 15.2.1-7.1.el10_2, gcc-toolset-15-offload-nvptx 15.2.1-7.1.el10_2, gcc-toolset-15-gcc-plugin-annobin 15.2.1-7.1.el10_2
    fixed: vendor fix RHSA-2026:89891
  • Red Hat Enterprise Linux BaseOS (v. 8) gcc 8.5.0-30.el8_10, libgcc 8.5.0-30.el8_10, libitm 8.5.0-30.el8_10, libasan 8.5.0-30.el8_10, libgomp 8.5.0-30.el8_10, liblsan 8.5.0-30.el8_10, +7 more Red Hat Enterprise Linux CRB (v. 8) cpp-debuginfo 8.5.0-30.el8_10, gcc-debuginfo 8.5.0-30.el8_10, gcc-debugsource 8.5.0-30.el8_10, gcc-plugin-devel 8.5.0-30.el8_10, libgcc-debuginfo 8.5.0-30.el8_10, libitm-debuginfo 8.5.0-30.el8_10, +19 more
    fixed: vendor fix RHSA-2026:89830
  • Red Hat Hardened Images cpp 16.2.1-3.hum1, gcc 16.2.1-3.hum1, cpp 16.2.1-3.2.hum1, gcc 16.2.1-3.2.hum1, libgcc 16.2.1-3.hum1, libitm 16.2.1-3.hum1, +46 more
    fixed: vendor fix RHSA-2026:95581
  • Red Hat Enterprise Linux 8 liblsan, libasan8, libtsan2, gcc-toolset-14-gcc, gcc-toolset-14-gcc-c++, gcc-toolset-14-libgccjit, +3 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 9 gcc-toolset-16 16.0-1.el10 Red Hat Enterprise Linux 10 gcc-toolset-16 16.0-1.el10
    not affected: component not present
show 2 more
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
41 d ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-825 Expired Pointer Dereference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.