CVE-2026-102010

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

A moderate-impact use-after-free flaw was found in the libstdc++ pb_ds binary heap implementation of the GNU Compiler Collection (GCC), affecting the gcc, gcc-toolset-15-gcc, and mingw-gcc components in Red Hat Enterprise Linux 10 and products that build on RHEL components, including OpenShift Container Platform RHEL CoreOS images and Red Hat hardened images, as well as Fedora community packages. When an application calls the erase_if() member function on a __gnu_pbds::priority_queue that uses the binary_heap_tag backend, the library reallocates the internal entry array but fails to update the m_a_entries pointer. Subsequent heap operations, such as make_heap(), then operate on the freed storage, and object teardown may free the stale pointer again, resulting in heap memory corruption that can crash or destabilize the affected application (denial of service) or cause other in-process memory corruption. Exploitation requires an application to specifically use the non-default pb_ds binary_heap_tag container type and invoke erase_if() on it; no default or remotely reachable vulnerable path is known in the shipped packages. Although the CVSS:3.1 base score for this flaw is 7.0, Red Hat rates its impact as Moderate because of this narrow, opt-in reachability, and a fix is being pursued for the affected products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications can mitigate this issue by avoiding calls to erase_if() on __gnu_pbds::priority_queue containers that use the binary_heap_tag backend. Where predicate-based removal is required, use an alternative container or a different heap backend in application code. Apart from applying a fixed package when one becomes available, no other mitigation is currently available.