CVE-2026-121996 · Runtime
NO FIX YET
gdbserver's agent-expression parser does not validate a length field, so a remote attacker can read uninitialized heap memory from the gdbserver process. The same flaw can crash the process, and the leaked addresses can help defeat ASLR in a later attack.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems where gdbserver (shipped with Red Hat Enterprise Linux, including the gcc-toolset-14 and gcc-toolset-15 gdb packages per the feed) is running with its port reachable over the network. Red Hat says an attacker with network access to the port can leak heap memory or crash gdbserver without authentication. Upstream GDB version ranges are not stated; skip it if gdbserver is not installed or runs only over local or stdio connections.
Not affected if gdbserver-not-installed, local-only-debugging
Who cares debugging, embedded, gdbserver, network-exposed, rhel
No fix yet, per the sources.
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.