---
id: CVE-2026-123151
title: 'Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail'
summary: >-
  A flaw was found in the GNU debugger (GDB). When GDB connects to a remote
  debug target, a malicious target can cause GDB to overflow a buffer on the
  stack while parsing the target's replies. This can crash GDB or potentially
  allow the ta…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-121
vendor: Red Hat
product: crash
affected:
  - crash
  - gdb (all versions)
  - gdb (all versions)
  - gdb (all versions)
  - crash
  - gcc-toolset-14-gdb
  - gcc-toolset-15-gdb
  - gdb (all versions)
  - crash
  - gdb (all versions)
  - gdb (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T21:13:04.424690Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:13:24.847Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123151'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-123151'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2567333'
    label: RHBZ#2567333
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:32.036Z'
---

## Overview

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.

## Affected

- `crash`
- `gdb (all versions)`
- `gdb (all versions)`
- `gdb (all versions)`
- `crash`
- `gcc-toolset-14-gdb`
- `gcc-toolset-15-gdb`
- `gdb (all versions)`
- `crash`
- `gdb (all versions)`
- `gdb (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

There is no mitigation for this vulnerability. Users should only connect GDB to trusted debug targets.