---
id: "CVE-2026-121995"
kind: "vulnerability"
aliases: ["CVE-2026-121995"]
title: "GDB: malicious debug stub can overflow the stack during 'target remote' connection when it reports tracepoint support"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "gdb", "fixed": [], "affected": "RHEL gdb and gcc-toolset-14/15 gdb; fixed version not published as of this check", "ecosystem": "redhat"}]
ecosystems: []
tags: ["debugging", "gdb", "remote-debugging", "rhel", "runtime"]
not_affected_if: ["local-debugging-only", "trusted-stub", "trusted-targets-only"]
published_at: "2026-11-05T17:18:00+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:44:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121995", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-121995", "first_seen_at": "2026-11-05T17:44:08+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-121995"]}]
exploit_sources: []
---

# GDB: malicious debug stub can overflow the stack during 'target remote' connection when it reports tracepoint support

A stack buffer overflow in GDB's tracepoint upload handler (parse_tracepoint_definition). GDB reads past the end of the current reply into a stale earlier reply in the shared packet buffer. A debug stub the attacker controls can corrupt GDB's stack during the target remote handshake, when the stub reports tracepoint support. Red Hat says that on its own the bug cannot bypass the stack canary, so code execution would need a separate memory leak from an earlier connection in the same GDB process. The victim must connect to the stub.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- redhat:gdb affected RHEL gdb and gcc-toolset-14/15 gdb; fixed version not published as of this check fixed no fixed version listed

## How to check

Run gdb --version and rpm -q gdb, and compare against Red Hat's errata for CVE-2026-121995. Also check whether you use target remote or extended-remote against stubs you do not control.

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121995
- 2026-11-05T17:44:08+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-121995 — Read Red Hat's CVE page (vendor). No upstream GDB advisory, affected range or fixed release found; fix left unknown. Red Hat says RHEL's GDB is affected and offers no mitigation. Settle by checking the Bugzilla 2565677 or the sourceware commit.

## Documents

- [advisory] Red Hat CVE-2026-121995 https://access.redhat.com/security/cve/CVE-2026-121995

## From the sources

A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_