{"id":"CVE-2026-121995","aliases":["AZL-113134","AZL-113155","DEBIAN-CVE-2026-121995","EUVD-2026-117572","GHSA-gxgg-8p4f-8xhq","UBUNTU-CVE-2026-121995"],"status":"published","title":"Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs-\u003ebuf tail","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00293,"percentile":0.22159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2026-11-05T16:08:49Z","modified":"2026-11-11T14:17:32Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"crash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.0.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.2-11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.1-3","13.2-1","13.2-1+hurd.3","15.1-1","15.2-1","15.2-2~exp1","16.0.90.20250111-1~exp1","16.0.90.20250111-1~exp2","16.1-1","16.1-2","16.1-2+hurd.1","16.2-1","16.2-2","16.2-3","16.2-4","16.2-5","16.2-6","16.2-7","16.2-8","16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.10-1ubuntu2","7.10-1ubuntu3","7.10.1-0ubuntu1","7.10.90.20160215-0ubuntu2","7.10.90.20160220-0ubuntu1","7.11-0ubuntu1","7.11.1-0ubuntu1~16.04","7.11.1-0ubuntu1~16.5","7.11.1-0ubuntu1~16.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-0ubuntu1","8.0.1-0ubuntu2","8.0.1-0ubuntu3","8.1-0ubuntu1","8.1-0ubuntu2","8.1-0ubuntu3","8.1-0ubuntu3.1","8.1-0ubuntu3.2","8.1.1-0ubuntu1","8.1.1-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3-0ubuntu1","9.0.50.20191019-0ubuntu1","9.0.50.20191119-0ubuntu1","9.0.90.20191216-0ubuntu1","9.0.90.20200105-0ubuntu1","9.0.90.20200117-0ubuntu1","9.1-0ubuntu1","9.2-0ubuntu1~20.04","9.2-0ubuntu1~20.04.1","9.2-0ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.1-0ubuntu2","11.1-0ubuntu3","11.2-0ubuntu1","12.0.50.20220217-0ubuntu1","12.0.90-0ubuntu1","12.1-0ubuntu1~22.04","12.1-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.50.20230907-0ubuntu1","14.1-0ubuntu1","14.1-0ubuntu2","15.0.50.20240219-0ubuntu1","15.0.50.20240320-0ubuntu1","15.0.50.20240403-0ubuntu1","15.1-1ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.1-2ubuntu1","17.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1ubuntu2","16.3-5ubuntu1","17.1-1ubuntu1","17.1-1ubuntu2","17.1-2ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121995","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565677","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121995","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gxgg-8p4f-8xhq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121995","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-121995","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121995","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-121995","title":"Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs-\u003ebuf tail","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T16:08:49.66Z","modified":"2026-11-09T17:18:06.93Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-09T19:34:28.960398Z"}],"euvd":[{"id":"EUVD-2026-117572","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T16:08:49Z","modified":"2026-11-09T17:18:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-gxgg-8p4f-8xhq","title":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker...","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T18:33:15Z","modified":"2026-11-05T18:33:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-05T18:55:28.046839Z"}],"nvd":[{"id":"CVE-2026-121995","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T17:18:00.69Z","modified":"2026-11-09T18:17:23.293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-09T20:15:34.274131Z"}],"osv":[{"id":"DEBIAN-CVE-2026-121995","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T17:18:00.69Z","modified":"2026-11-10T09:47:29.609324086Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T10:26:30.347596Z"},{"id":"UBUNTU-CVE-2026-121995","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:46:15.255322426Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"AZL-113134","title":"CVE-2026-121995 affecting package crash 9.0.0-3","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T17:18:00Z","modified":"2026-11-11T14:17:31.631998315Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113155","title":"CVE-2026-121995 affecting package gdb 13.2-11","description":"A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.","status":"published","published":"2026-11-05T17:18:00Z","modified":"2026-11-11T14:17:32.183539797Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}