CVE-2018-12886

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

• CWE-209

• https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markupVendor Advisory
• https://www.gnu.org/software/gcc/gcc-8/changes.htmlExploit, Vendor Advisory
• https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markupVendor Advisory
• https://www.gnu.org/software/gcc/gcc-8/changes.htmlExploit, Vendor Advisory

Published

May 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1288In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.…5.4
• CVE-2018-12880Adobe Acrobat and Reader versions 2018.011.20063 and earlier…
• CVE-2018-12881Adobe Acrobat and Reader versions 2018.011.20063 and earlier…
• CVE-2018-12882exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through …
• CVE-2018-12884In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenti…
• CVE-2018-12885The randMod() function of the smart contract implementation …
• CVE-2018-12889An issue was discovered in CCN-lite 2.0.1. There is a heap-b…
• CVE-2018-1289In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-i…
• CVE-2018-12891An issue was discovered in Xen through 4.10.x. Certain PV MM…
• CVE-2018-12892An issue was discovered in Xen 4.7 through 4.10.x. libxl fai…
• CVE-2018-12893An issue was discovered in Xen through 4.10.x. One of the fi…
• CVE-2018-12895WordPress through 4.9.6 allows Author users to execute arbit…8.8