{"id":"CVE-2026-121995","kind":"vulnerability","aliases":["CVE-2026-121995"],"related":[],"title":"GDB: malicious debug stub can overflow the stack during 'target remote' connection when it reports tracepoint support","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","summary":"A stack buffer overflow in GDB's tracepoint upload handler (parse_tracepoint_definition). GDB reads past the end of the current reply into a stale earlier reply in the shared packet buffer. A debug stub the attacker controls can corrupt GDB's stack during the target remote handshake, when the stub reports tracepoint support. Red Hat says that on its own the bug cannot bypass the stack canary, so code execution would need a separate memory leak from an earlier connection in the same GDB process. The victim must connect to the stub.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gdb","fixed":[],"affected":"RHEL gdb and gcc-toolset-14/15 gdb; fixed version not published as of this check","ecosystem":"redhat"}],"ecosystems":[],"tags":["debugging","gdb","remote-debugging","rhel","runtime"],"not_affected_if":["local-debugging-only","trusted-stub","trusted-targets-only"],"how_to_check":"Run gdb --version and rpm -q gdb, and compare against Red Hat's errata for CVE-2026-121995. Also check whether you use target remote or extended-remote against stubs you do not control.","fix":null,"status":"open","published_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:23+00:00","updated_at":"2026-11-05T17:44:08+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T17:42:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GDB: tracepoint upload overflow lets a rogue debug stub corrupt memory","impact":"high","summary":"GDB's client reads past the end of a reply when uploading tracepoints, overflowing a stack buffer. A malicious debug stub that GDB connects to can corrupt GDB's stack during connection setup.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["gdb","debugging","remote-debugging"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker-controlled stub corrupts GDB stack memory, possibly running code","analyst_note":"Find the affected GDB version range and fixed release in the NVD entry or the GDB project advisory to confirm exposure.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["local-debugging-only","trusted-stub"],"who_is_affected":"Affects people who run GDB as a client and connect it to a remote debug stub (gdbserver or similar) they do not fully trust. The sources do not say which GDB versions are affected or whether a local-only setup is safe.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4224,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected GDB version range and fixed release in the NVD entry or the GDB project advisory to confirm exposure.","search":"'-121995':20A,23A '-2026':19A,22A 'allow':137C 'attack':68B,140C 'attacker-control':139C 'automat':148C 'beyond':158C 'boundari':162C 'buffer':34B,63B,127C,172C 'bug':94B 'bypass':96B 'canari':99B 'cannot':95B 'client':132C 'code':101B 'connect':12A,112B,121B,150C 'control':69B,141C 'corrupt':71B,145C 'current':52B,160C 'cve':18A,21A 'debug':3A,25B,29B,65B,142C 'definit':44B 'earlier':57B,111B 'end':49B 'execut':102B 'gdb':1A,24A,26B,37B,45B,72B,116B,131C,156C 'handler':41B,136C 'handshak':79B 'hat':87B 'leak':108B 'malici':2A 'memori':107B,147C 'must':120B 'need':104B 'overflow':6A,35B,128C,153C 'packet':62B,171C 'pars':42B 'past':47B 'prior':166C 'process':117B 'read':46B,157C 'red':86B 'remot':11A,28B,78B 'remote-debug':27B 'repli':53B,58B,161C,167C 'report':15A,83B 'result':154C 'rhel':30B 'runtim':31B 'say':88B 'separ':106B 'setup':151C 'share':61B,170C 'stack':8A,33B,74B,98B,126C,146C 'stale':56B,165C 'stub':4A,66B,82B,124B,143C 'support':17A,85B 'target':10A,77B 'tracepoint':16A,39B,43B,84B,134C 'upload':40B,135C 'victim':119B 'would':103B","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs GDB and connects with target remote to a debug stub they do not control or trust (remote boards, emulators, third-party gdbserver-style stubs, CI or lab targets) is exposed. Red Hat states its shipped GDB is affected. If you only debug local programs or connect only to trusted targets, you can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-11-05T17:44:08Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121995","run_id":1803}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["gdb"],"ptokens":["gdb"],"labels":["debugging","gdb","high","remotedebugging","rhel","runtime"],"campaign_type":null,"first_public_at":"2026-11-05T17:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121995","severity":null,"published_at":"2026-11-05T17:18:00+00:00","modified_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121995:1803","url":"https://access.redhat.com/security/cve/CVE-2026-121995","severity":null,"published_at":"2026-11-05T17:44:08+00:00","modified_at":"2026-11-05T17:44:08+00:00","first_seen_at":"2026-11-05T17:44:08+00:00","fetched_at":"2026-11-05T17:44:08+00:00","note":"Read Red Hat's CVE page (vendor). No upstream GDB advisory, affected range or fixed release found; fix left unknown. Red Hat says RHEL's GDB is affected and offers no mitigation. Settle by checking the Bugzilla 2565677 or the sourceware commit.","cites":["https://access.redhat.com/security/cve/CVE-2026-121995"]}],"documents":[{"id":78326,"url":"https://access.redhat.com/security/cve/CVE-2026-121995","title":"Red Hat CVE-2026-121995","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}