---
id: "CVE-2026-123151"
kind: "vulnerability"
aliases: ["CVE-2026-123151"]
title: "GDB: malicious remote debug target can overflow stack and run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "gdb", "linux", "remote-debugging", "runtime"]
not_affected_if: ["local-debugging-only", "no-remote-targets"]
published_at: "2026-11-05T17:18:03+00:00"
first_seen_at: "2026-11-05T17:40:04+00:00"
updated_at: "2026-11-05T17:42:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123151", "first_seen_at": "2026-11-05T17:40:04+00:00"}]
exploit_sources: []
---

# GDB: malicious remote debug target can overflow stack and run code

GNU Debugger (GDB) overflows a stack buffer while parsing replies from a remote debug target. A malicious target can crash GDB or run arbitrary code in the GDB client with the privileges of the user running it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `gdb --version` to see the installed GDB version and compare it with the fixed version, which the sources do not state.
- Check whether developers connect GDB to remote targets (for example `target remote` or `gdbserver` sessions) against hosts they do not fully trust.

## Timeline

- 2026-11-05T17:40:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123151

## From the sources

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_