Bug 2537811 (CVE-2026-95619)

Summary: CVE-2026-95619 gcc: libstdc++ integer overflow in `new` operator
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, crizzo, dpaolell, gbenhaim, gtanzill, jbuscemi, jdelft, jupierce, kaycoth, lgarciaa, mbiarnes, niyer, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, twaugh, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-22 10:46:08 UTC 
An integer overflow triggered when processing inputs to the C++ `new` operator in libstdc+-v3/libsupc+/new_opa.cc where sz + align could overflow with large sz or align, potentially resulting in an undersized allocation instead of throwing bad_alloc. Note that this only affects older gcc versions since 12.4 onwards (see pr113258) prefer posix_memalign over aligned_alloc so on the RHEL front this should only affect RHEL9 and RHEL8 system gcc. The older libstdc++ (8.5.0) has a slightly different variant of that expression but has the same overflow problem.