Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-13732

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:16.3-3.1.el10_2 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:8.2-20.1.el8_10 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:16.3-3.1.el9_8 to < *unaffected

Red Hat Red Hat Cost Management On-Premise 1

Default version status: affected

  • 1791460851 to < *unaffected

Red Hat Red Hat Hardened Images

Default version status: affected

  • 17.2-6.2.hum1 to < *unaffected

Red Hat Red Hat Update Infrastructure 5

Default version status: affected

  • 1791978534 to < *unaffected

Red Hat Red Hat Update Infrastructure 5

Default version status: affected

  • 1791978528 to < *unaffected

Red Hat Red Hat Update Infrastructure 5

Default version status: affected

  • 1791978528 to < *unaffected

Red Hat Red Hat Update Infrastructure 5

Default version status: affected

  • 1791964013 to < *unaffected

Red Hat Red Hat Update Infrastructure 5

Default version status: affected

  • 1791978693 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: affected

Red Hat Red Hat Enterprise Linux 7

Default version status: affected

References