{"id":"CVE-2026-121994","kind":"vulnerability","aliases":["CVE-2026-121994"],"related":[],"title":"GDB: remote protocol handler overflow lets a debug target run code","description":"A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.","summary":"The GDB debugger's remote protocol handler writes a register reply into a stack buffer without checking its size. A malicious debug target can overflow that buffer and run arbitrary code inside the GDB process.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gdb","fixed":[],"affected":"RHEL 6, 7, 8, 9, 10 and Hardened Images (per Red Hat; some streams unaffected)","ecosystem":"redhat"}],"ecosystems":[],"tags":["debugging","embedded","gdb","other"],"not_affected_if":["local-debugging-only","trusted-targets-only"],"how_to_check":"- Run `gdb --version`; Red Hat lists its shipped gdb on RHEL 6, 7, 8, 9, 10 and Hardened Images as affected (some RHEL 8/9/10 streams listed unaffected; upstream version range not published).\n- Check whether anyone runs `target remote` / `target extended-remote` to a gdbserver, emulator or board you do not control, and then reads registers (p packet).","fix":"No fixed release published as of 2026-11-05 (Red Hat Bugzilla 2565676 status NEW). Only connect GDB to trusted debug targets.","status":"open","published_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:08+00:00","updated_at":"2026-11-05T17:42:50+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-05T17:42:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GDB: remote protocol handler overflow lets a debug target run code","impact":"high","summary":"The GDB debugger's remote protocol handler writes a register reply into a stack buffer without checking its size. A malicious debug target can overflow that buffer and run arbitrary code inside the GDB process.","audience":"developers","category":"other","nicknames":[],"who_cares":["gdb","debugging","embedded"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker code runs inside the GDB process on the developer's machine","analyst_note":"Confirm affected GDB versions and whether a fixed release exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121994.","how_to_check":"- Run `gdb --version` to see which GDB release is installed\n- Check whether any workflow connects GDB to untrusted remote targets, such as `target remote` to a host you do not control","plain_action":"","needs_analyst":true,"not_affected_if":["local-debugging-only","trusted-targets-only"],"who_is_affected":"Exposure requires GDB to connect to a remote debug stub that an attacker controls, for example a debugging session against an untrusted device or server. Teams that only debug local programs or trusted hardware targets are unlikely to be affected. The sources do not list affected GDB versions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4229,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected GDB versions and whether a fixed release exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121994.","search":"'-121994':14A,17A '-2026':13A,16A 'alloca':102C 'alloca-s':101C 'allow':69C 'arbitrari':51B,78C 'attack':72C 'attacker-control':71C 'bound':106C 'buffer':36B,48B,59C,104C 'check':38B 'client':64C 'code':11A,52B,79C 'control':73C 'cve':12A,15A 'debug':8A,19B,43B,74C 'debugg':24B 'decod':93C 'embed':20B 'execut':77C 'exist':86C 'fetch':88C 'gdb':1A,18A,21B,23B,55B,63C,82C 'handler':4A,28B,68C 'insid':53B 'let':6A 'malici':42B 'overflow':5A,46B,60C 'p':91C 'process':56B,83C 'protocol':3A,27B,67C 'regist':31B,89C,97C,110C 'remot':2A,26B,66C 'repli':32B,98C 'run':10A,50B 'size':40B,103C 'stack':35B,58C 'stub':95C 'target':9A,44B,75C 'use':90C 'vulner':85C 'width':111C 'without':37B,105C 'write':29B,107C","nicknames":[],"mitigations":[],"who_affected":"Developers who connect GDB to a malicious or compromised remote debug stub (RSP) and read registers are exposed to code execution in their GDB process. Red Hat confirms its shipped gdb is affected. Anyone debugging only local programs or fully trusted targets can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T17:42:50Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121994","run_id":1799},"who_affected":{"at":"2026-11-05T17:42:50Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121994","run_id":1799}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["gdb"],"ptokens":["gdb"],"labels":["debugging","embedded","gdb","high","other"],"campaign_type":null,"first_public_at":"2026-11-05T17:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121994","severity":null,"published_at":"2026-11-05T17:18:00+00:00","modified_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121994:1799","url":"https://access.redhat.com/security/cve/CVE-2026-121994","severity":null,"published_at":"2026-11-05T17:42:50+00:00","modified_at":"2026-11-05T17:42:50+00:00","first_seen_at":"2026-11-05T17:42:50+00:00","fetched_at":"2026-11-05T17:42:50+00:00","note":"Read Red Hat CVE page + Bugzilla 2565676 (primary, RH is CNA). No fix released (bug status NEW); RH says no mitigation, only connect to trusted targets. Upstream GDB versions not stated anywhere; no PoC, not exploited.","cites":["https://access.redhat.com/security/cve/CVE-2026-121994","https://bugzilla.redhat.com/show_bug.cgi?id=2565676"]}],"documents":[{"id":78321,"url":"https://access.redhat.com/security/cve/CVE-2026-121994","title":"Red Hat CVE-2026-121994","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78322,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565676","title":"Red Hat Bugzilla 2565676","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}