{"id":"CVE-2018-12886","aliases":["EUVD-2018-4839","GHSA-5mwp-7q9c-cgg2","UBUNTU-CVE-2018-12886"],"status":"published","title":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler...","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02738,"percentile":0.86254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-209"],"published":"2019-05-22T18:42:10Z","modified":"2026-10-24T10:30:15Z","affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gcc-4.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-10ubuntu8","4.8.2-1ubuntu1","4.8.2-1ubuntu2","4.8.2-10ubuntu1","4.8.2-10ubuntu2","4.8.2-12ubuntu2","4.8.2-13ubuntu1","4.8.2-14ubuntu1","4.8.2-14ubuntu2","4.8.2-14ubuntu4","4.8.2-15ubuntu3","4.8.2-16ubuntu1","4.8.2-16ubuntu3","4.8.2-16ubuntu4","4.8.2-16ubuntu5","4.8.2-16ubuntu6","4.8.2-17ubuntu1","4.8.2-17ubuntu2","4.8.2-19ubuntu1","4.8.4-2ubuntu1~14.04","4.8.4-2ubuntu1~14.04.1","4.8.4-2ubuntu1~14.04.3","4.8.4-2ubuntu1~14.04.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gcc-4.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.5-1ubuntu1","4.8.5-2ubuntu1","4.8.5-3ubuntu1","4.8.5-3ubuntu2","4.8.5-3ubuntu3","4.8.5-4ubuntu1","4.8.5-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gcc-4.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.3-5ubuntu1","4.9.3-6ubuntu2","4.9.3-8ubuntu1","4.9.3-8ubuntu2","4.9.3-9ubuntu1","4.9.3-11ubuntu1","4.9.3-11ubuntu2","4.9.3-12ubuntu1","4.9.3-13ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:4.9.3+svn227297-1","15:4.9.3+svn227297-1build1","15:4.9.3+svn231177-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20151011-0ubuntu1","20151030-1ubuntu2","20151104-0ubuntu1","20151122-1ubuntu1","20151209-0ubuntu1","20151215-0ubuntu1","20160105-1ubuntu1","20160125-1ubuntu1","20160320-1ubuntu1","20160415-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.0-8ubuntu3","7.2.0-12ubuntu1","7.2.0-13ubuntu1","7.2.0-16ubuntu1","7.2.0-17ubuntu1","7.2.0-18ubuntu2","7.3.0-3ubuntu1","7.3.0-5ubuntu1","7.3.0-11ubuntu1","7.3.0-12ubuntu1","7.3.0-13ubuntu1","7.3.0-14ubuntu1","7.3.0-15ubuntu2","7.3.0-16ubuntu2","7.3.0-16ubuntu3","7.3.0-27ubuntu1~18.04","7.4.0-1ubuntu1~18.04","7.4.0-1ubuntu1~18.04.1","7.5.0-3ubuntu1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8-20180208-0ubuntu1","8-20180218-1ubuntu1","8-20180312-2ubuntu1","8-20180319-1ubuntu2","8-20180321-1ubuntu1","8-20180331-1ubuntu1","8-20180402-1ubuntu1","8-20180406-0ubuntu1","8-20180408-0ubuntu1","8-20180414-1ubuntu1","8-20180414-1ubuntu2","8.2.0-1ubuntu2~18.04","8.3.0-6ubuntu1~18.04","8.3.0-6ubuntu1~18.04.1","8.3.0-26ubuntu1~18.04","8.4.0-1ubuntu1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-4.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.5-4ubuntu6","4.8.5-4ubuntu7","4.8.5-4ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.0-8ubuntu1","6.4.0-9ubuntu1","6.4.0-10ubuntu1","6.4.0-11ubuntu1","6.4.0-12ubuntu1","6.4.0-13ubuntu1","6.4.0-15ubuntu1","6.4.0-16ubuntu1","6.4.0-17ubuntu1","6.5.0-2ubuntu1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:5.4.1+svn241155-1","15:6.3.1+svn253039-1","15:6.3.1+svn253039-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20171017-1ubuntu1","20171109-1ubuntu1","20180107-1ubuntu1","20180130-0ubuntu2","20180216-1ubuntu1","1:20180322-1ubuntu1","1:20180425-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gcc-7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.0-14ubuntu2","7.4.0-15ubuntu1","7.5.0-1ubuntu1","7.5.0-2ubuntu1","7.5.0-3ubuntu1","7.5.0-4ubuntu1","7.5.0-4ubuntu4","7.5.0-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gcc-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.0-23ubuntu2","8.3.0-24ubuntu1","8.3.0-25ubuntu3","8.3.0-26ubuntu1","8.3.0-27ubuntu1","8.3.0-29ubuntu1","8.3.0-29ubuntu2","8.4.0-1ubuntu1","8.4.0-1ubuntu3","8.4.0-3ubuntu1","8.4.0-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:7-2018-q2-6","15:8-2019-q3-1","15:9-2019-q4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:9-2019-q4-0ubuntu2","15:10.3-2021.07-1","15:10.3-2021.07-2","15:10.3-2021.07-3","15:10.3-2021.07-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20210827-1ubuntu1","1:20220117-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:12.2.rel1-1","15:13.2.rel1-1","15:13.2.rel1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230928-1ubuntu1","1:20231130-1ubuntu1","1:20240117-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:14.2.rel1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20250322-1ubuntu1","1:20250502-1ubuntu1","1:20250601-1ubuntu1","1:20250617-1ubuntu1","1:20250804-1ubuntu1","1:20250828-1ubuntu1","1:20250921-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:14.2.rel1-1","15:15.3.rel1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20260306-1ubuntu1","1:20260902-1ubuntu1","1:20260920-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gcc-arm-none-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15:14.2.rel1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gcc-snapshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20250921-1ubuntu1","1:20251023-1ubuntu1","1:20260121-1ubuntu1","1:20260203-0ubuntu3","1:20260216-1ubuntu1","1:20260306-1ubuntu1"]}],"products":[{"vendor":"gnu","product":"gcc"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://www.gnu.org/software/gcc/gcc-8/changes.html","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence"]},{"url":"https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379\u0026view=markup","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-565386.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886"},{"url":"https://github.com/advisories/GHSA-5mwp-7q9c-cgg2"},{"url":"https://ubuntu.com/security/CVE-2018-12886","tags":["report"]},{"url":"https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=89d7557202d25a393666ac4c0f7dbdab31e452a2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12886","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","status":"published","published":"2019-05-22T18:42:10Z","modified":"2026-10-14T06:30:34.554Z","updated_at":"2026-11-02T14:35:06.679212Z"}],"euvd":[{"id":"EUVD-2018-4839","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","status":"published","published":"2019-05-22T18:42:10Z","modified":"2026-10-14T06:30:34Z","updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-5mwp-7q9c-cgg2","title":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler...","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","status":"published","published":"2022-05-24T16:46:11Z","modified":"2026-10-14T09:31:22Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","status":"published","published":"2019-05-22T19:29:00.297Z","modified":"2026-10-14T07:16:41.957Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","status":"published","published":"2019-05-22T19:29:00.297Z","modified":"2026-10-24T10:30:15.923993512Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"UBUNTU-CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.","status":"published","published":"2019-05-22T19:29:00Z","modified":"2026-10-17T12:54:52.346068354Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"}]}}