GDB · CVE-2026-121995 · Runtime
NO FIX YET
A stack buffer overflow in GDB's tracepoint upload handler (parse_tracepoint_definition). GDB reads past the end of the current reply into a stale earlier reply in the shared packet buffer. A debug stub the attacker controls can corrupt GDB's stack during the target remote handshake, when the stub reports tracepoint support. Red Hat says that on its own the bug cannot bypass the stack canary, so code execution would need a separate memory leak from an earlier connection in the same GDB process. The victim must connect to the stub.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone who runs GDB and connects with target remote to a debug stub they do not control or trust (remote boards, emulators, third-party gdbserver-style stubs, CI or lab targets) is exposed. Red Hat states its shipped GDB is affected. If you only debug local programs or connect only to trusted targets, you can skip it.
Not affected if local-debugging-only, trusted-stub, trusted-targets-only
Who cares debugging, gdb, remote-debugging, rhel
rpm -q gdb, and compare against Red Hat's errata for CVE-2026-121995No fix yet, per the sources.
A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.