{"id":"CVE-2026-121997","aliases":["DEBIAN-CVE-2026-121997","EUVD-2026-117574","GHSA-jq36-9pw3-8r4v","UBUNTU-CVE-2026-121997"],"status":"published","title":"Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0071,"percentile":0.53815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-122"],"published":"2026-11-05T16:08:54Z","modified":"2026-11-07T01:46:15Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.1-3","13.2-1","13.2-1+hurd.3","15.1-1","15.2-1","15.2-2~exp1","16.0.90.20250111-1~exp1","16.0.90.20250111-1~exp2","16.1-1","16.1-2","16.1-2+hurd.1","16.2-1","16.2-2","16.2-3","16.2-4","16.2-5","16.2-6","16.2-7","16.2-8","16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.10-1ubuntu2","7.10-1ubuntu3","7.10.1-0ubuntu1","7.10.90.20160215-0ubuntu2","7.10.90.20160220-0ubuntu1","7.11-0ubuntu1","7.11.1-0ubuntu1~16.04","7.11.1-0ubuntu1~16.5","7.11.1-0ubuntu1~16.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-0ubuntu1","8.0.1-0ubuntu2","8.0.1-0ubuntu3","8.1-0ubuntu1","8.1-0ubuntu2","8.1-0ubuntu3","8.1-0ubuntu3.1","8.1-0ubuntu3.2","8.1.1-0ubuntu1","8.1.1-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3-0ubuntu1","9.0.50.20191019-0ubuntu1","9.0.50.20191119-0ubuntu1","9.0.90.20191216-0ubuntu1","9.0.90.20200105-0ubuntu1","9.0.90.20200117-0ubuntu1","9.1-0ubuntu1","9.2-0ubuntu1~20.04","9.2-0ubuntu1~20.04.1","9.2-0ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.1-0ubuntu2","11.1-0ubuntu3","11.2-0ubuntu1","12.0.50.20220217-0ubuntu1","12.0.90-0ubuntu1","12.1-0ubuntu1~22.04","12.1-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.50.20230907-0ubuntu1","14.1-0ubuntu1","14.1-0ubuntu2","15.0.50.20240219-0ubuntu1","15.0.50.20240320-0ubuntu1","15.0.50.20240403-0ubuntu1","15.1-1ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.1-2ubuntu1","17.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1ubuntu2","16.3-5ubuntu1","17.1-1ubuntu1","17.1-1ubuntu2","17.1-2ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121997","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565679","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121997"},{"url":"https://github.com/advisories/GHSA-jq36-9pw3-8r4v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121997","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-121997","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121997","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-121997","title":"Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","status":"published","published":"2026-11-05T16:08:54.309Z","modified":"2026-11-06T19:55:40.804Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-06T20:30:04.265548Z"}],"euvd":[{"id":"EUVD-2026-117574","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","status":"published","published":"2026-11-05T16:08:54Z","modified":"2026-11-06T19:55:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-jq36-9pw3-8r4v","title":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote...","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","status":"published","published":"2026-11-05T18:33:15Z","modified":"2026-11-05T18:33:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-05T18:55:28.046839Z"}],"nvd":[{"id":"CVE-2026-121997","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","status":"published","published":"2026-11-05T17:18:01.053Z","modified":"2026-11-06T05:18:25.43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-06T06:59:08.172215Z"}],"osv":[{"id":"DEBIAN-CVE-2026-121997","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","status":"published","published":"2026-11-05T17:18:01.053Z","modified":"2026-11-06T15:03:00.691187685Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T15:27:36.398977Z"},{"id":"UBUNTU-CVE-2026-121997","description":"A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:46:15.489350471Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T01:56:47.245871Z"}]}}