GDB · CVE-2026-121997 · Runtime
NO FIX YET
A heap buffer overflow in gdbserver's QTDPsrc packet handler happens when a packet's declared source length does not match the real data length, so hex2bin writes past the allocated buffer. An unauthenticated remote attacker can get native code execution inside the gdbserver process.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
gdbserver as shipped with Red Hat Enterprise Linux is affected per Red Hat. Anyone running gdbserver on a network-reachable port (embedded or remote debugging, lab and CI targets) lets an unauthenticated attacker send a crafted QTDPsrc packet and run code as the gdbserver user. Teams that only use gdb locally, or run gdbserver over SSH tunnels or loopback only, can skip it. Other distributions and upstream GDB versions are not confirmed.
Not affected if gdbserver-not-installed, local-only-debugging, loopback-only, no-gdbserver
Who cares debugging, embedded, gdb, gdbserver, remote-debugging, rhel
rpm -q gdb-gdbserver gdb) and whether it listens on a network port (ss -ltnp | grep gdbserver)No fix yet, per the sources.
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.