This vulnerability arises from an integer overflow in the libstdc++ new operator used in applications compiled with older gcc versions on Red Hat Enterprise Linux 8 and 9. The overflow can cause undersized memory allocations when handling large inputs, potentially resulting in memory corruption or application instability. The flaw is classified under CWE-190 (Integer Overflow or Wraparound) and can lead to denial of service through crashes or resource exhaustion, as well as integrity impacts such as memory modification. Red Hat has published an advisory but currently does not provide an official fix or mitigation that meets their standards for ease of use, applicability, and stability.

The vulnerability can cause undersized memory allocations, leading to memory corruption or application instability. This may result in denial of service conditions such as crashes or resource exhaustion. Integrity of applications may be compromised due to memory modification. The CVSS v3.1 score is 7.7 (high), reflecting network attack vector with high complexity and no privileges or user interaction required. Confidentiality impact is low, but integrity and availability impacts are high.

Red Hat currently does not offer an official fix or mitigation that meets their product security criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat's advisory page for updates. Upgrading to supported product versions that include a fix, once available, is recommended. Customers with Red Hat Technical Account Managers (TAM) can consult directly for guidance. No temporary or partial mitigations are currently endorsed by Red Hat.