The flaw resides in the libstdc++ C++ library where an integer overflow can occur when processing very large requests to the aligned operator new. This overflow results in the allocation of an undersized memory block, potentially corrupting the heap or causing application instability. The weakness is classified as CWE‑190 and no evidence of arbitrary code execution is provided.

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The exact versions of libstdc++ that are vulnerable are not specified in the CNA data, so the scope is limited to the products listed but the specific component versions remain unknown.

With a CVSS base score of 7.7 the vulnerability is considered high severity. The EPSS score is not available and it is not listed in CISA’s KEV catalog, so no mass exploitation has been documented. Attackers would need to supply a specially crafted, very large allocation request that triggers the affected new operator in a vulnerable C++ application. If the target application is exposed to an untrusted source, remote exploitation is theoretically possible; otherwise the vector remains local. Successful exploitation can corrupt the heap, leading to crashes, denial of service, or, if the application logic or an attacker can influence control flow after the corruption, broader compromise.