Bug 2569390 (CVE-2026-125709)

Summary: CVE-2026-125709 libstdc++: overflow leaves streambuf in inconsistent state on I/O error.
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, crizzo, dpaolell, gtanzill, jbuscemi, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2569396, 2569397, 2569398, 2569399, 2569400, 2569401, 2569402, 2569403, 2569404    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-10 10:38:41 UTC
Basically if an fstream bytewise write using `stream->putc()` fails due 
to an error (e.g. a transient disk failure or ENOSPCE), the operation 
ends up writing the char into the backing buffer anyway and multiple 
such operations could eventually result in writing arbitrary bytes 
beyond the backing buffer.  Note that a typical stream write (i.e. 
stream << "foo" ) is not affected by this.

Requisites for an attack:

1. Ability to invoke a write failure by, e.g. chaining a different 
vulnerability that allows such access
2. Finding a target suid application or service that calls 
`stream->putc()` in a user-controlled path
3. Ability to already control the execution frequency of 
`stream->putc()` to cause a buffer overflow.

There are no suid applications that use this pattern AFAIK, so I don't 
think there's a local attack vector here at all, only a network one 
through a service.  There's no confidentiality compromise either AFAICT, 
there's only a minor risk of data corruption and a small incremental 
(given the already compromised ability to invoke a storage failure) risk 
of DoS due to invoking a crash in the target service that meets all of 
the above criteria.