#1150196 gcc-14: CVE-2026-102010

Package:
src:gcc-14
Source:
src:gcc-14
Submitter:
Moritz Mühlenhoff
Date:
2026-10-09 11:09:04 UTC
Severity:
normal
Tags:
#1150196#5
Date:
2026-10-06 20:15:07 UTC
From:
To:
Hi,

The following vulnerability was published for gcc-14.

CVE-2026-102010[0]:
| A flaw was found in GCC. When an application calls the erase_if
| function on a binary heap priority queue in libstdc++, the library
| reallocates storage but fails to update its internal entry pointer.
| An attacker capable of triggering this operation can exploit this
| use-after-free condition, leading to a Denial of Service (DoS) via
| an application crash or potential memory corruption.

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102010
https://www.cve.org/CVERecord?id=CVE-2026-102010

Please adjust the affected versions in the BTS as needed.
#1150196#12
Date:
2026-10-09 11:06:37 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
gcc-14, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150196@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matthias Klose <doko@debian.org> (supplier of updated gcc-14 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 09 Oct 2026 12:37:47 +0200
Source: gcc-14
Architecture: source
Version: 14.4.0-3
Distribution: unstable
Urgency: medium
Maintainer: Debian GCC Maintainers <debian-gcc@lists.debian.org>
Changed-By: Matthias Klose <doko@debian.org>
Closes: 1150196
Changes:
 gcc-14 (14.4.0-3) unstable; urgency=medium
 .
   * Update to git 20261009 from the gcc-14 branch.
     - Fix PR target/127650 (x86), PR target/127482 (AVR),
       PR target/107549 (xtensa), PR target/127500 (x86),
       PR target/126932 (RISCV), PR target/126463 (AArch64),
       PR target/126196 (RISCV), PR rtl-optimization/125683, PR ada/126125,
       PR c++/125642, PR c++/126483, PR c++/126280, PR fortran/127187,
       PR libstdc++/127666, PR libstdc++/126364, PR libstdc++/122224,
       PR libstdc++/124015, PR libstdc++/114400, PR libstdc++/123409,
       PR libstdc++/123510, PR libstdc++/118665, PR libstdc++/127006,
       PR libstdc++/126452, PR libstdc++/126849, PR libstdc++/116110,
       PR libstdc++/124852.
     - Fix PR libstdc++/127656: Fix use-after-free in pbds binary heap,
       CVE-2026-102010. Closes: #1150196.
Checksums-Sha1:
 3a85792db6cdccc5f97c2fe2016fb78b1fae2c6f 42370 gcc-14_14.4.0-3.dsc
 3aafd75a0661f76978bf1968ab9dd4b908700067 645304 gcc-14_14.4.0-3.debian.tar.xz
 e4f41ff0b990cbb9615bfecfe02df41e01765b49 10968 gcc-14_14.4.0-3_source.buildinfo
Checksums-Sha256:
 8119964a484b7864db64d92af693d49d9fc2f2ff421b21c24b228da5f2bc2072 42370 gcc-14_14.4.0-3.dsc
 10681a2b2131ad91e85b0fec9be8e0b3666a5c27814546583cd596b0ef765f12 645304 gcc-14_14.4.0-3.debian.tar.xz
 69487523c4ca58471f4d84e001169c726adece9fd0a145c6d3d20e8b49dfe33d 10968 gcc-14_14.4.0-3_source.buildinfo
Files:
 652926d96d57e4b3041ba187e31937ae 42370 devel optional gcc-14_14.4.0-3.dsc
 abbb267ad7d5675c604d0fea7fe1661e 645304 devel optional gcc-14_14.4.0-3.debian.tar.xz
 da4675151769c44fbab5667a403a3071 10968 devel optional gcc-14_14.4.0-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEE1WVxuIqLuvFAv2PWvX6qYHePpvUFAmrIxK0QHGRva29AZGVi
aWFuLm9yZwAKCRC9fqpgd4+m9YDcD/45x/dpUa56WPFhQ1RT4CZ9pSBTEH51jjOA
FwZ+bGvFMNOYS74Xf3nLQzMlufeG/lHpCov+RztVrSRCtHV/dDkJj5jLCZXD/SUb
g0k/x1Pj+StYzYu++RdDmaryTSo7PRusIkjJ2yixEl8XNKBcQDixf0V9S02XRlHZ
10jxNAIwOTQGvNODSdkQUKfpdsXzSZZ9Y2vxp/S6AqkXGualVSWxIC7Uo0SoWKXt
CGcG3/kbc5DPrn7ZuA2ldQDz3kgaLxNQDtxGqjmz3NBuyFytfw9CzeH06bzwvRxP
/6Q4GqvOVeoz7C+MvHF+wC2AvgIaNtIo8z7xSZ/OOgASTWxNdFWZHR1LL8Ep0QoI
/p0ri0ykysLpUDgwqVhvRw+UJfIKNeodPZUgfpbZnOQ5F0Z5s8q+2a24zQ7/h25a
38Ry9TqY0/XR2AAU6J02Lu0QBhHUhnZfvBTjyb8oyC+ZsxhnliL3JdpEubMN21/E
Nfi9Dg5MQ+JyghY7J8ZBSF5rN0l3f5Uq6+MOaQKpuElMu8IOpUXqZnJtcHRmWjRD
KB+Lb8JHlBBl1/F09WYSKlO2rFHZBAmUdYdMNQDGiFMC5yjpUykIF5tcaBWLFQO+
mbsrb8kW4XerhiCZzv5ADSGTCFjog1XaHuqE5Dyre24mRGMG2yp/EgFlAcN2mR7W
hWEYHnCd3Q==
=zv6W
-----END PGP SIGNATURE-----