Hi,

The following vulnerability was published for gcc-13.

CVE-2026-102010[0]:
| A flaw was found in GCC. When an application calls the erase_if
| function on a binary heap priority queue in libstdc++, the library
| reallocates storage but fails to update its internal entry pointer.
| An attacker capable of triggering this operation can exploit this
| use-after-free condition, leading to a Denial of Service (DoS) via
| an application crash or potential memory corruption.

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102010
https://www.cve.org/CVERecord?id=CVE-2026-102010

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
gcc-13, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150197@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matthias Klose <doko@debian.org> (supplier of updated gcc-13 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 09 Oct 2026 10:44:42 +0200
Source: gcc-13
Architecture: source
Version: 13.5.0-2
Distribution: unstable
Urgency: medium
Maintainer: Debian GCC Maintainers <debian-gcc@lists.debian.org>
Changed-By: Matthias Klose <doko@debian.org>
Closes: 1150197
Changes:
 gcc-13 (13.5.0-2) unstable; urgency=medium
 .
   * Fix PR libstdc++/127656: Fix use-after-free in pbds binary heap,
     taken from the gcc-14 branch.  CVE-2026-102010. Closes: #1150197.
Checksums-Sha1:
 db13901507a210e25ebe9094ca088475c8b36325 38914 gcc-13_13.5.0-2.dsc
 3fe5ee48986d673bb4f72782949441cfe14a6293 580676 gcc-13_13.5.0-2.debian.tar.xz
 5909101168d73e834ef84c9f04ce97af732afa1c 8495 gcc-13_13.5.0-2_source.buildinfo
Checksums-Sha256:
 b6873490ba0b5a7402a1c05418cf26e2985c41959c80028ad6d2363c5926da3f 38914 gcc-13_13.5.0-2.dsc
 fe75b5c1503e7dd113ccd14c143c235bfd5b43d1c4a7527c5a404cf2eea57e80 580676 gcc-13_13.5.0-2.debian.tar.xz
 bf343025ae1ad04aa9667b63d8ecc0e4240ba51b0a9c6355775c9efded158c33 8495 gcc-13_13.5.0-2_source.buildinfo
Files:
 0bc0649927c486cfe835e9da4bd70a38 38914 devel optional gcc-13_13.5.0-2.dsc
 4bc5585efbf01a02df43930b21caa4ce 580676 devel optional gcc-13_13.5.0-2.debian.tar.xz
 0f9bc3f429a00ad2c8669d6039aae0be 8495 devel optional gcc-13_13.5.0-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEE1WVxuIqLuvFAv2PWvX6qYHePpvUFAmrIro4QHGRva29AZGVi
aWFuLm9yZwAKCRC9fqpgd4+m9b60D/9vHtM60uX2Lt4r1RkN7HwfR4fa2pkasFRt
ZEag8TGoPqGoyVK5AnDqfUFAQAGCtLCcQO1+kuhqbxDtLOESFoG6Lx1UXiSLewLL
4ux+01fQmbTFBZ1rRev+BWwiemq/3IZShfMI91+fTzV19+j2ScgUIHnEv8Iw2YdW
PA/OBN+pSbvJgeXwi/0soUAcj4lLQ7R7lRDmNoIzaLF5g2ToRPX6f0YKk7en/nvH
V729+fWPdajhx5lk7EQJdLoWMONzmfUFb2K5Myj7K8MNEMk6ICQmXRA/nRTRWwaJ
ChXDCJaswJMKWnKc+ZPg2wHey1DsnknkV1wWyi8dfucaQkHavdvW6u8M0wXLjbeH
Jdb3FWpuAg1NWJKqOEq8SK5lnGsqC2nh+o7lCYrPly1iluP4z9f9W9U6P6ctUKPH
wnvZNB1bQShNwpzFOAefvqKbbChhhiiHHLK4nPRkqELW+WaFn0KZKlUW0ofBuy6N
Y0y+qJw9lfHdjs1npPDobBocTXoFUkGueKQPcI8rGKXGFsrwGSOJcuO22Y9i5qKr
dNeUW63SuCZ+ICM+1g51xRc9B8xZK90xYnA7ZaT5tZyX7qlPVnrCRPGUL2sFtEaj
dXgn+qfA0nfytJUsUUjiRnL0XD2kjUXWcodUSM6EDp+Ukx7CV9KcUi36P5JRwSZB
LiUAbZO1Gw==
=Soxs
-----END PGP SIGNATURE-----