https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656
--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Jonathan Wakely <[email protected]>: https://gcc.gnu.org/g:aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6 commit r17-4744-gaaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6 Author: Jonathan Wakely <[email protected]> Date: Fri Sep 25 18:14:34 2026 +0100 libstdc++: Fix use-after-free in pbds binary heap (CVE-2026-102010) [PR127656] After reallocating the storage the m_a_entries pointer is left dangling and the new storage is leaked. libstdc++-v3/ChangeLog: PR libstdc++/127656 * include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp (erase_if): Update m_a_entries after reallocation. * testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc: New test. Reviewed-by: Tomasz KamiÅski <[email protected]>
