https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656
--- Comment #6 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The releases/gcc-16 branch has been updated by Jonathan Wakely <[email protected]>: https://gcc.gnu.org/g:4fcaf5b1154d9cb929c5e47b509f59a801e94a5c commit r16-9713-g4fcaf5b1154d9cb929c5e47b509f59a801e94a5c Author: Jonathan Wakely <[email protected]> Date: Fri Sep 25 18:14:34 2026 +0100 libstdc++: Fix use-after-free in pbds binary heap (CVE-2026-102010) [PR127656] After reallocating the storage the m_a_entries pointer is left dangling and the new storage is leaked. libstdc++-v3/ChangeLog: PR libstdc++/127656 * include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp (erase_if): Update m_a_entries after reallocation. * testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc: New test. Reviewed-by: Tomasz KamiÅski <[email protected]> (cherry picked from commit aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6)
