{"id":"CVE-2026-121994","title":"Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length","summary":"A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's regis…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-121"],"vendor":"Red Hat","product":"crash","affected":["crash","gdb (all versions)","gdb (all versions)","gdb (all versions)","crash","gcc-toolset-14-gdb (all versions)","gcc-toolset-15-gdb (all versions)","gdb (all versions)","crash","gdb (all versions)","gdb (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-05T17:25:53.959151Z"},"published":"2026-11-05","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:55:31.918Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121994","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121994"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565676","label":"RHBZ#2565676"}],"tags":["cve.org"],"epss":0.00481,"epssPercentile":0.41694,"ingestedAt":"2026-11-05T22:38:31.494Z","slug":"CVE-2026-121994","body":"## Overview\n\nA stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.\n\n## Affected\n\n- `crash`\n- `gdb (all versions)`\n- `gdb (all versions)`\n- `gdb (all versions)`\n- `crash`\n- `gcc-toolset-14-gdb (all versions)`\n- `gcc-toolset-15-gdb (all versions)`\n- `gdb (all versions)`\n- `crash`\n- `gdb (all versions)`\n- `gdb (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThere is no mitigation for this vulnerability. Users should only connect GDB to trusted debug targets.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce bounds checking against register size when decoding remote serial protocol register replies in the GDB client remote protocol handler: upgrade to the corresponding fixed Red Hat builds, which bounds RSP register reply decoding to the allocated register size rather than terminating only on NUL bytes, closing all 2 injection vectors (oversized RSP register reply, truncated RSP register reply stack disclosure). Until patched, this is a concern on Linux systems running GDB clients connecting to remote RSP debug targets, so Only connect the GDB client to known, trusted debug targets and avoid attaching to unverified or hostile remote RSP stubs. As a compensating measure, Enforce SELinux in enforcing mode to confine the actions of a compromised GDB process, Deploy an EDR agent to detect anomalous process behavior and post-exploitation payloads spawned from GDB, Monitor kernel syscall activity via eBPF to detect unexpected commands or shells spawned by the GDB client, Enable Address Space Layout Randomization to randomize userspace memory addresses, and Enable the NX/XD bit to block direct shellcode execution from stack memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack buffer overflow defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}