{"id":"CVE-2026-121996","kind":"vulnerability","aliases":["CVE-2026-121996"],"related":[],"title":"gdbserver: agent-expression length flaw leaks heap memory and crashes remotely","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","summary":"gdbserver's agent-expression parser does not validate a length field, so a remote attacker can read uninitialized heap memory from the gdbserver process. The same flaw can crash the process, and the leaked addresses can help defeat ASLR in a later attack.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["debugging","embedded","gdbserver","network-exposed","rhel","runtime"],"not_affected_if":["gdbserver-not-installed","local-only-debugging"],"how_to_check":"- Is gdbserver installed: run 'gdbserver --version' and 'rpm -q gdb gdb-gdbserver' on RHEL-family hosts.\n- Is it listening on the network: 'ss -ltnp' and look for gdbserver.\n- Fixed versions: not published on the Red Hat page yet (Bugzilla 2565678); recheck https://access.redhat.com/security/cve/CVE-2026-121996.","fix":null,"status":"open","published_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","triaged_at":"2026-11-05T17:42:13+00:00","updated_at":"2026-11-05T17:44:13+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T17:42:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"gdbserver: agent-expression length flaw leaks heap memory and crashes remotely","impact":"medium","summary":"gdbserver's agent-expression parser does not validate a length field, so a remote attacker can read uninitialized heap memory from the gdbserver process. The same flaw can crash the process, and the leaked addresses can help defeat ASLR in a later attack.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gdbserver","debugging","embedded"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reads heap memory and crashes the gdbserver process","analyst_note":"Confirm affected and fixed gdbserver versions and whether the flaw needs gdbserver in remote mode; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121996 for the version ranges.","how_to_check":"- Check whether gdbserver is installed and which version: `gdbserver --version`\n- Check whether gdbserver is listening on a network port, for example with `ss -ltnp` and looking for gdbserver\n- Affected and fixed version ranges: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["local-only-debugging","gdbserver-not-installed"],"who_is_affected":"Only systems where gdbserver is running and reachable over the network are exposed; a local debugging session on a developer machine is not reachable from the internet. Teams that use gdbserver for remote debugging of embedded or test targets should check those hosts. unknown for the exact affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4219,"output_tokens":608,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected and fixed gdbserver versions and whether the flaw needs gdbserver in remote mode; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121996 for the version ranges.","search":"'-121996':15A,18A '-2026':14A,17A 'address':62B,106C 'agent':3A,30B,79C 'agent-express':2A,29B,78C 'allow':82C 'aslr':66B,110C 'attack':42B,70B,86C 'caus':97C 'content':104C 'crash':11A,56B 'cve':13A,16A 'debug':19B 'defeat':65B,109C 'denial':99C 'disclos':102C 'embed':20B 'exploit':113C 'expos':24B 'express':4A,31B,80C 'field':38B 'flaw':6A,54B,74C 'gdbserver':1A,21B,27B,50B,76C,94C 'heap':8A,46B,90C,103C 'help':64B 'includ':105C 'later':69B 'leak':7A,61B 'length':5A,37B,72C 'memori':9A,47B,91C 'network':23B 'network-expos':22B 'parser':32B,81C 'process':51B,58B,95C 'read':44B,88C 'remot':12A,41B,85C 'rhel':25B 'runtim':26B 'servic':101C 'suitabl':107C 'unauthent':84C 'uniniti':45B,89C 'valid':35B,73C","nicknames":[],"mitigations":[],"who_affected":"Systems where gdbserver (shipped with Red Hat Enterprise Linux, including the gcc-toolset-14 and gcc-toolset-15 gdb packages per the feed) is running with its port reachable over the network. Red Hat says an attacker with network access to the port can leak heap memory or crash gdbserver without authentication. Upstream GDB version ranges are not stated; skip it if gdbserver is not installed or runs only over local or stdio connections.","tier":"B","verified":{"who_affected":{"at":"2026-11-05T17:44:13Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121996","run_id":1802}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["debugging","embedded","gdbserver","high","networkexposed","rhel","runtime"],"campaign_type":null,"first_public_at":"2026-11-05T17:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121996","severity":null,"published_at":"2026-11-05T17:18:00+00:00","modified_at":"2026-11-05T17:18:01+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","fetched_at":"2026-11-05T17:40:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121996:1802","url":"https://access.redhat.com/security/cve/CVE-2026-121996","severity":null,"published_at":"2026-11-05T17:44:13+00:00","modified_at":"2026-11-05T17:44:13+00:00","first_seen_at":"2026-11-05T17:44:13+00:00","fetched_at":"2026-11-05T17:44:13+00:00","note":"Red Hat CNA page read: flaw present in gdbserver as shipped with RHEL; no mitigation; gdbserver has no authentication. Page gives no fixed versions or upstream ranges, so fix stays unknown. No PoC or exploitation seen.","cites":["https://access.redhat.com/security/cve/CVE-2026-121996","https://nvd.nist.gov/vuln/detail/CVE-2026-121996"]}],"documents":[{"id":78327,"url":"https://access.redhat.com/security/cve/CVE-2026-121996","title":"CVE-2026-121996 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78328,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121996","title":"NVD CVE-2026-121996","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}