{"id":"CVE-2026-121997","kind":"vulnerability","aliases":["CVE-2026-121997"],"related":[],"title":"gdbserver: heap overflow in QTDPsrc packet lets remote attacker run code","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","summary":"A heap buffer overflow in gdbserver's QTDPsrc packet handler happens when a packet's declared source length does not match the real data length, so hex2bin writes past the allocated buffer. An unauthenticated remote attacker can get native code execution inside the gdbserver process.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gdb","fixed":[],"affected":"unknown versions; gdbserver shipped with RHEL","ecosystem":"redhat"}],"ecosystems":[],"tags":["debugging","embedded","gdb","gdbserver","remote-debugging","rhel","runtime"],"not_affected_if":["gdbserver-not-installed","local-only-debugging","loopback-only","no-gdbserver"],"how_to_check":"Check whether gdbserver is installed (RHEL: rpm -q gdb-gdbserver gdb) and whether it listens on a network port (ss -ltnp | grep gdbserver). Any gdbserver reachable over the network is exposed; gdbserver has no authentication. Fixed version: unknown, Red Hat has not published one on its CVE page.","fix":null,"status":"open","published_at":"2026-11-05T17:18:01+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","triaged_at":"2026-11-05T17:42:16+00:00","updated_at":"2026-11-05T17:44:02+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T17:42:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"gdbserver: heap overflow in QTDPsrc packet lets remote attacker run code","impact":"high","summary":"A heap buffer overflow in gdbserver's QTDPsrc packet handler happens when a packet's declared source length does not match the real data length, so hex2bin writes past the allocated buffer. An unauthenticated remote attacker can get native code execution inside the gdbserver process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gdbserver","embedded","debugging"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs native code inside the gdbserver process remotely","analyst_note":"Find the affected and fixed gdbserver/GDB versions and any upstream patch via the NVD entry and the GDB project's advisories.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["local-only-debugging","gdbserver-not-installed"],"who_is_affected":"Teams that run gdbserver remotely to debug a target over the network are exposed, since the flaw is reached by sending crafted remote protocol packets. Local debugging sessions bound to localhost and machines where gdbserver is not installed can skip it. The sources do not say which gdbserver versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4242,"output_tokens":506,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed gdbserver/GDB versions and any upstream patch via the NVD entry and the GDB project's advisories.","search":"'-121997':14A,17A '-2026':13A,16A 'achiev':89C 'actual':112C 'alloc':58B,121C 'allow':83C 'attack':9A,63B,87C 'beyond':119C 'buffer':30B,59B,75C,123C 'caus':115C 'code':11A,67B,91C 'cve':12A,15A 'data':51B,113C 'debug':19B,25B 'declar':43B,107C 'embed':20B 'execut':68B,92C 'gdb':18A,21B 'gdbserver':1A,22B,33B,71B,78C,95C 'get':65B 'handler':37B,82C 'happen':38B 'heap':2A,29B,74C,122C 'hex2bin':54B,116C 'insid':69B 'length':45B,52B,109C,114C 'let':7A 'match':48B 'mismatch':102C 'nativ':66B,90C 'overflow':3A,31B,76C 'packet':6A,36B,41B,81C,105C 'past':56B 'process':72B,96C 'qtdpsrc':5A,35B,80C 'real':50B 'remot':8A,24B,62B,86C 'remote-debug':23B 'result':99C 'rhel':26B 'run':10A 'runtim':27B 'sourc':44B,108C 'unauthent':61B,85C 'vulner':98C 'write':55B,118C","nicknames":[],"mitigations":[],"who_affected":"gdbserver as shipped with Red Hat Enterprise Linux is affected per Red Hat. Anyone running gdbserver on a network-reachable port (embedded or remote debugging, lab and CI targets) lets an unauthenticated attacker send a crafted QTDPsrc packet and run code as the gdbserver user. Teams that only use gdb locally, or run gdbserver over SSH tunnels or loopback only, can skip it. Other distributions and upstream GDB versions are not confirmed.","tier":"B","verified":{"who_affected":{"at":"2026-11-05T17:44:02Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121997","run_id":1801}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gdb"],"ptokens":["gdb"],"labels":["debugging","embedded","gdb","gdbserver","high","remotedebugging","rhel","runtime"],"campaign_type":null,"first_public_at":"2026-11-05T17:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121997","severity":null,"published_at":"2026-11-05T17:18:01+00:00","modified_at":"2026-11-05T17:18:01+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","fetched_at":"2026-11-05T17:40:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121997:1801","url":"https://access.redhat.com/security/cve/CVE-2026-121997","severity":null,"published_at":"2026-11-05T17:44:02+00:00","modified_at":"2026-11-05T17:44:02+00:00","first_seen_at":"2026-11-05T17:44:02+00:00","fetched_at":"2026-11-05T17:44:02+00:00","note":"Red Hat CVE page read (only primary found; NVD page empty, no upstream GDB advisory/patch found, GDB 18.1 news doesn't mention it). Red Hat lists no fixed version and says no mitigation; fix status unknown. Red Hat scores AC:H 8.1, notes dispute for 9.8. No exploitation or PoC seen.","cites":["https://access.redhat.com/security/cve/CVE-2026-121997"]}],"documents":[{"id":78324,"url":"https://access.redhat.com/security/cve/CVE-2026-121997","title":"Red Hat CVE-2026-121997","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}