CVE-2015-5276: The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not pr...

Security readout for executives and security teams

This issue affects GCC libstdc++ std::random_device before GCC 4.9.4. In some conditions, it could return weaker randomness after short reads, making generated values easier to predict. Business risk depends on whether applications used this API for security-sensitive secrets. Exposure is most likely in legacy Linux or build environments using GCC/libstdc++ before 4.9.4, especially applications compiled against affected libraries and relying on std::random_device for security-sensitive randomness. Treat this as a targeted legacy dependency risk, not an internet-wide emergency. Prioritize environments where old libstdc++ versions support authentication, cryptography, licensing, or token generation. Mitigation focus: Identify systems shipping GCC/libstdc++ before 4.9.4 or vendor-patched equivalents.; Apply vendor GCC/libstdc++ updates from the relevant Linux distribution.; Review applications using std::random_device for secrets, tokens, keys, or session material..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.