Hi,
The following vulnerabilities were published for gcc-14.
CVE-2026-114690[0]:
| A flaw was found in GCC. An out-of-bounds memory access
| vulnerability exists in the libstdc++ parallel search implementation
| due to an undersized internal buffer. A local attacker can exploit
| this flaw by providing crafted search data to an application
| compiled with parallel mode, causing the process to crash and
| leading to a Denial of Service (DoS).
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c1f32b67510f6f9998deadaef5090b6663adb979 (main)
https://bugzilla.redhat.com/show_bug.cgi?id=2478652
CVE-2026-114691[1]:
| A flaw was found in the libstdc++ component of GCC. An attacker who
| can provide an excessively large element count to a boolean vector
| (std::vector<bool>) constructor can trigger an integer wrap during
| internal memory calculations. This issue leaves the container in an
| inconsistent state, leading to out-of-bounds memory access and
| resulting in an application crash or a Denial of Service (DoS)
| during subsequent operations.
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=2fd8866591b5aea7098835f80ab7e176382175ae
https://bugzilla.redhat.com/show_bug.cgi?id=2478508
CVE-2026-115455[2]:
| A flaw was found in GCC libstdc++. When an application extracts data
| into a bitset from a wide-character stream, internal stack memory
| allocation fails to properly account for character size and
| alignment. An attacker capable of supplying crafted input to an
| affected application could trigger a stack-based buffer overflow
| leading denial of service (DoS).
https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219
https://bugzilla.redhat.com/show_bug.cgi?id=2562933
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-114690
https://www.cve.org/CVERecord?id=CVE-2026-114690
[1] https://security-tracker.debian.org/tracker/CVE-2026-114691
https://www.cve.org/CVERecord?id=CVE-2026-114691
[2] https://security-tracker.debian.org/tracker/CVE-2026-115455
https://www.cve.org/CVERecord?id=CVE-2026-115455
Please adjust the affected versions in the BTS as needed.