{"id":"CVE-2026-121996","aliases":["AZL-113128","AZL-113146","DEBIAN-CVE-2026-121996","EUVD-2026-117573","GHSA-px57-gjvm-vwfx","UBUNTU-CVE-2026-121996"],"status":"published","title":"Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00471,"percentile":0.41215,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-822"],"published":"2026-11-05T16:08:52Z","modified":"2026-11-11T14:17:32Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"crash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.0.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.2-11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.1-3","13.2-1","13.2-1+hurd.3","15.1-1","15.2-1","15.2-2~exp1","16.0.90.20250111-1~exp1","16.0.90.20250111-1~exp2","16.1-1","16.1-2","16.1-2+hurd.1","16.2-1","16.2-2","16.2-3","16.2-4","16.2-5","16.2-6","16.2-7","16.2-8","16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.10-1ubuntu2","7.10-1ubuntu3","7.10.1-0ubuntu1","7.10.90.20160215-0ubuntu2","7.10.90.20160220-0ubuntu1","7.11-0ubuntu1","7.11.1-0ubuntu1~16.04","7.11.1-0ubuntu1~16.5","7.11.1-0ubuntu1~16.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-0ubuntu1","8.0.1-0ubuntu2","8.0.1-0ubuntu3","8.1-0ubuntu1","8.1-0ubuntu2","8.1-0ubuntu3","8.1-0ubuntu3.1","8.1-0ubuntu3.2","8.1.1-0ubuntu1","8.1.1-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3-0ubuntu1","9.0.50.20191019-0ubuntu1","9.0.50.20191119-0ubuntu1","9.0.90.20191216-0ubuntu1","9.0.90.20200105-0ubuntu1","9.0.90.20200117-0ubuntu1","9.1-0ubuntu1","9.2-0ubuntu1~20.04","9.2-0ubuntu1~20.04.1","9.2-0ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.1-0ubuntu2","11.1-0ubuntu3","11.2-0ubuntu1","12.0.50.20220217-0ubuntu1","12.0.90-0ubuntu1","12.1-0ubuntu1~22.04","12.1-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.50.20230907-0ubuntu1","14.1-0ubuntu1","14.1-0ubuntu2","15.0.50.20240219-0ubuntu1","15.0.50.20240320-0ubuntu1","15.0.50.20240403-0ubuntu1","15.1-1ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.1-2ubuntu1","17.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1ubuntu2","16.3-5ubuntu1","17.1-1ubuntu1","17.1-1ubuntu2","17.1-2ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121996","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565678","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121996","tags":["web"]},{"url":"https://github.com/advisories/GHSA-px57-gjvm-vwfx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121996","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-121996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121996","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-121996","title":"Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T16:08:52.127Z","modified":"2026-11-06T19:55:34.343Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-822"],"updated_at":"2026-11-06T20:30:04.265548Z"}],"euvd":[{"id":"EUVD-2026-117573","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T16:08:52Z","modified":"2026-11-06T19:55:34Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-px57-gjvm-vwfx","title":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote...","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T18:33:15Z","modified":"2026-11-05T18:33:24Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-822"],"updated_at":"2026-11-05T18:55:28.046839Z"}],"nvd":[{"id":"CVE-2026-121996","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T17:18:00.87Z","modified":"2026-11-05T19:17:16.407Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-822"],"updated_at":"2026-11-05T21:56:50.099578Z"}],"osv":[{"id":"DEBIAN-CVE-2026-121996","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T17:18:00.87Z","modified":"2026-11-06T15:03:00.672013006Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T15:27:36.398977Z"},{"id":"UBUNTU-CVE-2026-121996","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:46:15.490979784Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"AZL-113128","title":"CVE-2026-121996 affecting package crash 9.0.0-3","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T17:18:00Z","modified":"2026-11-11T14:17:31.527447435Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113146","title":"CVE-2026-121996 affecting package gdb 13.2-11","description":"A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.","status":"published","published":"2026-11-05T17:18:00Z","modified":"2026-11-11T14:17:32.187760838Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}