CVE-2018-12886 — gcc: spilling of stack protection address in cfgexpand.c and function.c leads to stack-overflow protection bypass

Back Back to CVE browser

HIGH

gcc: spilling of stack protection address in cfgexpand.c and function.c leads to stack-overflow protection bypass

Published May 22, 2019

8.1

HIGH

CVSS 3.0

EPSS 2.17%

Description

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

Affected products

Red Hat Enterprise Linux 4

gcc

Not affected
Red Hat Enterprise Linux 4

gcc4

Not affected
Red Hat Enterprise Linux 5

gcc

Not affected
Red Hat Enterprise Linux 5

gcc44

Not affected
Red Hat Enterprise Linux 6

gcc

Not affected
Red Hat Enterprise Linux 7

gcc

Not affected
Red Hat Enterprise Linux 8

gcc

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 4	gcc	Not affected	n/a
Red Hat Enterprise Linux 4	gcc4	Not affected	n/a
Red Hat Enterprise Linux 5	gcc	Not affected	n/a
Red Hat Enterprise Linux 5	gcc44	Not affected	n/a
Red Hat Enterprise Linux 6	gcc	Not affected	n/a
Red Hat Enterprise Linux 7	gcc	Not affected	n/a
Red Hat Enterprise Linux 8	gcc	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

2.17% 0.02171

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.02171

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	2.17% (0.02171)	81.65th	v5 (v2026.06.15)
Jun 15, 2026	2.17% (0.02171)	79.86th	v5 (v2026.06.15)
Jul 20, 2024	0.29% (0.00294)	69.53th	v3 (v2023.03.01)
Feb 8, 2024	0.29% (0.00294)	68.35th	v3 (v2023.03.01)
Apr 28, 2023	0.29% (0.00294)	64.56th	v3 (v2023.03.01)
Mar 7, 2023	0.42% (0.00417)	70.07th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00885)	26.24th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.62% (0.00624)	17.80th	v1
Jan 6, 2022	0.62% (0.00624)	17.24th	v1
Sep 1, 2021	0.62% (0.00624)	45.04th	v1
Apr 14, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-209

References (6)

https://access.redhat.com/security/cve/CVE-2018-12886
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1715823
Issue Tracking
https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12886
https://www.cve.org/CVERecord?id=CVE-2018-12886
https://www.gnu.org/software/gcc/gcc-8/changes.html
x_refsource_MISCExploitVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-12886		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1715823		Issue Tracking
https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12886
https://www.cve.org/CVERecord?id=CVE-2018-12886
https://www.gnu.org/software/gcc/gcc-8/changes.html		x_refsource_MISCExploitVendor Advisory