---
id: "CVE-2026-121996"
kind: "vulnerability"
aliases: ["CVE-2026-121996"]
title: "gdbserver: agent-expression length flaw leaks heap memory and crashes remotely"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["debugging", "embedded", "gdbserver", "network-exposed", "rhel", "runtime"]
not_affected_if: ["gdbserver-not-installed", "local-only-debugging"]
published_at: "2026-11-05T17:18:00+00:00"
first_seen_at: "2026-11-05T17:40:04+00:00"
updated_at: "2026-11-05T17:44:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121996", "first_seen_at": "2026-11-05T17:40:04+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-121996", "first_seen_at": "2026-11-05T17:44:13+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-121996", "https://nvd.nist.gov/vuln/detail/CVE-2026-121996"]}]
exploit_sources: []
---

# gdbserver: agent-expression length flaw leaks heap memory and crashes remotely

gdbserver's agent-expression parser does not validate a length field, so a remote attacker can read uninitialized heap memory from the gdbserver process. The same flaw can crash the process, and the leaked addresses can help defeat ASLR in a later attack.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Is gdbserver installed: run 'gdbserver --version' and 'rpm -q gdb gdb-gdbserver' on RHEL-family hosts.
- Is it listening on the network: 'ss -ltnp' and look for gdbserver.
- Fixed versions: not published on the Red Hat page yet (Bugzilla 2565678); recheck https://access.redhat.com/security/cve/CVE-2026-121996.

## Timeline

- 2026-11-05T17:40:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121996
- 2026-11-05T17:44:13+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-121996 — Red Hat CNA page read: flaw present in gdbserver as shipped with RHEL; no mitigation; gdbserver has no authentication. Page gives no fixed versions or upstream ranges, so fix stays unknown. No PoC or exploitation seen.

## Documents

- [advisory] CVE-2026-121996 - Red Hat Customer Portal https://access.redhat.com/security/cve/CVE-2026-121996
- [mentions] NVD CVE-2026-121996 https://nvd.nist.gov/vuln/detail/CVE-2026-121996

## From the sources

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_