Hi, Upstream fix commits for the three libstdc++ CVEs, from the gcc-mirror/gcc branch history:
CVE-2026-114690 "Fix buffer overrun in __gnu_parallel search" master c1f32b67510f, gcc-16 f5808934bc17, gcc-15 b346c341218a, gcc-14 272e2eb081eb (all committed 2026-10-29) CVE-2026-114691 "Fix overflow in std::vector<bool> constructors" master 2fd8866591b5, gcc-16 2ab9ded76e87, gcc-15 dfc15010eda6, gcc-14 08f9fae91b64 (all committed 2026-10-29) CVE-2026-115455 "Fix stack corruption in std::bitset stream extraction [PR124370]" plus the follow-up "do not zero stack buffer in std::bitset extraction" master 5d419c69ce2e + 2763d2c22442 gcc-16 3723bab81697 + feac724ca2f7 (2026-10-14) gcc-15 2ffbcde8634f + 4e269ed1088e (2026-10-26) gcc-14 b0392114a03a + ad5ec18348ab (2026-10-27) Compared with the branch snapshots in the current unstable uploads: gcc-16 16.2.0-4 (git 20261024): already contains the CVE-2026-115455 fix. Its changelog entry lists PR libstdc++/124370, and debian/patches/git-updates.diff contains the new _Buffer code in include/std/bitset (no more __builtin_alloca(_Nb)). The 114690 and 114691 fixes are newer than the snapshot. gcc-15 15.3.0-5 (git 20261024): none of the three. The gcc-15 bitset backport is from 10-26. gcc-14 14.4.0-3 (git 20261009): none of the three. So the next branch update after 2026-10-29 picks up all three on each branch. For gcc-16, CVE-2026-115455 can probably be marked as fixed in 16.2.0-4. All three fixes are in libstdc++ headers (parallel/search.h, bits/stl_bvector.h, std/bitset), so programs only get them once they are rebuilt against the fixed headers. CVE-2026-114690 only affects code built with Parallel Mode (_GLIBCXX_PARALLEL). This is a static check of the upstream branch history and the Debian source packages only; I did not build gcc or run a reproducer. Regards
