CVE-2026-102010: MLflow — HIGH

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
compat-gcc-295	—	—	No patch
compat-gcc-296	—	—	No patch
compat-gcc-32	—	—	No patch
compat-gcc-34	—	—	No patch
compat-gcc-44	—	—	No patch
gcc	—	—	No patch
gcc-main	—	—	No patch
gcc-toolset-14-gcc	—	—	No patch
gcc-toolset-15-gcc	—	—	No patch
gcc-toolset-16	—	—	No patch
gcc-toolset-16-gcc	—	—	No patch
gcc13-main	—	—	No patch
mingw-gcc	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
rhoai/odh-ai-gateway-operator-rhel9	—	—	No patch
rhoai/odh-core-bff-rhel9	—	—	No patch
rhoai/odh-dashboard-operator-rhel9	—	—	No patch
rhoai/odh-dashboard-rhel9	—	—	No patch
rhoai/odh-data-science-pipelines-operator-controller-rhel9	—	—	No patch
rhoai/odh-kf-notebook-controller-rhel9	—	—	No patch
rhoai/odh-kserve-controller-rhel9	—	—	No patch
rhoai/odh-kserve-llmisvc-controller-rhel9	—	—	No patch
rhoai/odh-kserve-module-operator-rhel9	—	—	No patch
rhoai/odh-kube-rbac-proxy-rhel9	—	—	No patch
rhoai/odh-kuberay-operator-controller-rhel9	—	—	No patch
rhoai/odh-llama-stack-k8s-operator-rhel9	—	—	No patch
rhoai/odh-maas-controller-rhel9	—	—	No patch
rhoai/odh-mod-arch-agent-ops-rhel9	—	—	No patch
rhoai/odh-mod-arch-automl-rhel9	—	—	No patch
rhoai/odh-mod-arch-autorag-rhel9	—	—	No patch
rhoai/odh-mod-arch-eval-hub-rhel9	—	—	No patch
rhoai/odh-mod-arch-gen-ai-rhel9	—	—	No patch
rhoai/odh-mod-arch-maas-rhel9	—	—	No patch
rhoai/odh-mod-arch-model-registry-rhel9	—	—	No patch
rhoai/odh-model-controller-rhel9	—	—	No patch
rhoai/odh-model-registry-operator-rhel9	—	—	No patch
rhoai/odh-model-serving-api-rhel9	—	—	No patch
rhoai/odh-notebook-controller-rhel9	—	—	No patch
rhoai/odh-ogx-k8s-operator-rhel9	—	—	No patch
rhoai/odh-ogx-module-operator-rhel9	—	—	No patch
rhoai/odh-training-operator-rhel9	—	—	No patch
rhoai/odh-trustyai-service-operator-rhel9	—	—	No patch
rhoai/odh-workbenches-operator-rhel9	—	—	No patch
rteval-loads	—	—	No patch

How severe is it?

CVSS 3.1

7.0 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CLow

ILow

AHigh

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-102010?

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

Is CVE-2026-102010 actively exploited?

No confirmed active exploitation of CVE-2026-102010 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-102010?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-102010?

CVE-2026-102010 has a CVSS v3.1 base score of 7.0 (HIGH).

What are the technical details?

Original Advisory

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

Weaknesses (CWE)

CWE-825Expired Pointer Dereference

CWE-825 — Expired Pointer Dereference: The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

[Architecture and Design] Choose a language that provides automatic memory management.
[Implementation] When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE corpus.