CVE-2026-95619: libstdc++ Buffer Overflow Vulnerability

CVE-2026-95619 Overview

A flaw in the GNU Standard C++ Library (libstdc++) allows an integer overflow when the aligned operator new processes large size arguments. The overflow produces an undersized memory allocation that fails to reflect the caller's requested size. Subsequent writes into the allocation can corrupt adjacent heap memory or destabilize the running application.

The weakness is classified as [CWE-190] Integer Overflow or Wraparound. Any C++ application or library linked against a vulnerable libstdc++ that invokes aligned allocation with attacker-influenced size values inherits the exposure. Red Hat has issued advisories RHSA-2026:58503 and RHSA-2026:67275 addressing affected packages.

Critical Impact
Attackers who influence allocation sizes passed to aligned operator new can trigger heap corruption, enabling denial of service and potentially arbitrary code execution in the affected process.

Affected Products

GNU libstdc++ (GCC C++ Standard Library) — aligned operator new implementation
Red Hat Enterprise Linux packages addressed in RHSA-2026:58503
Red Hat Enterprise Linux packages addressed in RHSA-2026:67275

Discovery Timeline

2026-09-22 - CVE-2026-95619 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95619

Vulnerability Analysis

The defect resides in the aligned form of operator new provided by libstdc++. When servicing an allocation request, the implementation performs arithmetic on the requested size and alignment values before delegating to the underlying allocator. Large inputs cause the arithmetic to wrap around the fixed-width integer boundary, yielding a value smaller than the caller requested.

The allocator then returns a buffer sized according to the wrapped value. The calling code, unaware of the truncation, proceeds to write the full expected number of bytes. Those writes overflow the actual allocation and overwrite adjacent heap metadata or neighboring objects. The impact profile aligns with classic heap-based memory corruption, spanning application crashes, data integrity loss, and, under favorable conditions, control-flow hijacking.

Root Cause

The root cause is missing overflow validation on the size and alignment computation inside aligned operator new. The implementation trusts that the arithmetic result represents the true byte count requested. Because [CWE-190] arises before the allocator itself is invoked, downstream allocator hardening does not detect or reject the truncated request.

Attack Vector

Exploitation requires an attacker to control the size argument passed to aligned operator new, typically through untrusted input parsed by a C++ application. Network-reachable services that deserialize attacker-supplied length fields into aligned allocations present the primary exposure path. The high attack complexity reflects the need to reach a code path that performs aligned allocation with a size the attacker can drive past the overflow boundary.

No verified public exploit code is currently available. See the Red Hat CVE Analysis and Red Hat Bug Report #2537811 for additional technical context.

Detection Methods for CVE-2026-95619

Indicators of Compromise

Unexpected SIGABRT or SIGSEGV terminations in C++ services shortly after handling large or malformed input payloads.
Heap corruption diagnostics from glibc (for example, malloc(): memory corruption or free(): invalid pointer) surfacing in application logs.
Repeated crash-restart cycles in managed services that parse attacker-controlled length fields.

Detection Strategies

Inventory installed libstdc++ and GCC runtime versions across Linux hosts and compare against the fixed packages listed in RHSA-2026:58503 and RHSA-2026:67275.
Instrument development and staging builds with AddressSanitizer (-fsanitize=address) to catch aligned allocation overflows before production deployment.
Correlate application crash telemetry with inbound request sizes to identify probes that exercise oversized allocation paths.

Monitoring Recommendations

Forward core dump metadata and application crash events to a central log pipeline for trend analysis.
Monitor process memory growth and abnormal termination rates on services linked against libstdc++.
Track vendor advisories for downstream projects that statically link or bundle a vulnerable libstdc++.

How to Mitigate CVE-2026-95619

Immediate Actions Required

Apply the updated libstdc++ packages from RHSA-2026:58503 and RHSA-2026:67275 on affected Red Hat systems.
Restart all long-running C++ services and daemons after the library update so processes load the patched runtime.
Identify statically linked binaries built against vulnerable libstdc++ versions and rebuild them against the fixed toolchain.

Patch Information

Red Hat has published fixes in RHSA-2026:58503 and RHSA-2026:67275. Additional analysis is available in the Red Hat CVE Analysis and the Red Hat Bug Report #2537811. Consult your Linux distribution vendor for equivalent fixed package versions.

Workarounds

Enforce upper bounds on attacker-controlled length fields before they reach aligned allocation code paths in C++ services.
Reject or truncate deserialized size values that approach the platform size_t maximum to prevent the overflow condition.
Where feasible, run affected services under a memory-safe wrapper or sandbox that constrains the blast radius of heap corruption.

bash

# Verify installed libstdc++ version on Red Hat systems
rpm -q libstdc++

# Apply vendor updates addressing CVE-2026-95619
sudo dnf update libstdc++ gcc-c++

# Identify running processes still linked to the pre-patch library
sudo lsof 2>/dev/null | grep -i 'libstdc++' | awk '{print $1, $2}' | sort -u