CVE-2026-125709 Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

Medium 4.2 Published 10 Nov 2026 Updated 10 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125709?

CVE-2026-125709 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 10 Nov 2026.

Official description

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.

Weakness: CWE-787

Which versions are affected by CVE-2026-125709?

How do I fix CVE-2026-125709?

No fix has been published for CVE-2026-125709 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125709 being exploited?

There is no known exploitation of CVE-2026-125709 in the wild and no public exploit code.

Sources

Also known as GHSA-grvf-fp92-82c6, UBUNTU-CVE-2026-125709.