Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-4039

CVE-2023-4039MEDIUM

Arm Ltd Arm GNU Toolchain — GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  L  L  N    4.8   .0104   63.3     —

AFFECTED
  Product            Versions                                                                         Fixed
  Arm GNU Toolchain  All versions where option -fstack-protector is used –                            —
  GCC                All versions of GCC that target AArch64 when option -fstack-protector is used –  —

TIMELINE
  Aug 1   Reserved by Arm
  Sep 13  Published (CNA: Arm)
  Oct 14  EXPLOIT PUBLISHED — CVE-2023-4039 (Arm Ltd Arm GNU Toolchain). Public exploit reference added.

CWE-693 · CNA: Arm · CVSS v3.1 · 4 references · NVD status: Modified

Description

**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 1, 2023	Reserved	Reserved by Arm
September 13, 2023	Published	Published (CNA: Arm)
October 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-4039 (Arm Ltd Arm GNU Toolchain). Public exploit reference added.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Arm Ltd	Arm GNU Toolchain	—	All versions where option -fstack-protector is used	—
GNU	GCC	—	All versions of GCC that target AArch64 when option -fstack-protector is used	—

Weaknesses

CWE-693

References (4)

https://cert-portal.siemens.com/productcert/html/ssa-355557.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 [Exploit, Patch, Third Party Advisory]
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf [Exploit, Patch, Third Party Advisory]

Authoritative record: CVE-2023-4039 at cve.org

Vendors: arm · gnu

Weaknesses: CWE-693

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-4039 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.