{"id":"CVE-2026-123151","aliases":["AZL-113131","AZL-113158","DEBIAN-CVE-2026-123151","EUVD-2026-117575","GHSA-f82m-v9ch-rh67","UBUNTU-CVE-2026-123151"],"status":"published","title":"Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs-\u003ebuf tail","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00513,"percentile":0.44082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2026-11-05T16:08:57Z","modified":"2026-11-11T14:17:32Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"crash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.0.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.2-11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.1-3","13.2-1","13.2-1+hurd.3","15.1-1","15.2-1","15.2-2~exp1","16.0.90.20250111-1~exp1","16.0.90.20250111-1~exp2","16.1-1","16.1-2","16.1-2+hurd.1","16.2-1","16.2-2","16.2-3","16.2-4","16.2-5","16.2-6","16.2-7","16.2-8","16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1","16.3-2","16.3-3","16.3-4","16.3-4~bpo13+1","16.3-4~bpo13+2","16.3-5","16.3-5~bpo13+1","17.0.50.20250905-1~exp1","17.0.90-1~exp1","17.0.90-1~exp2","17.1-1","17.1-1~bpo13+1","17.1-2","17.1-3","17.1-4","17.2-1","17.2-1~bpo13+1","18.1-1","18.1-2","18.1-3","18.1-3~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.10-1ubuntu2","7.10-1ubuntu3","7.10.1-0ubuntu1","7.10.90.20160215-0ubuntu2","7.10.90.20160220-0ubuntu1","7.11-0ubuntu1","7.11.1-0ubuntu1~16.04","7.11.1-0ubuntu1~16.5","7.11.1-0ubuntu1~16.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-0ubuntu1","8.0.1-0ubuntu2","8.0.1-0ubuntu3","8.1-0ubuntu1","8.1-0ubuntu2","8.1-0ubuntu3","8.1-0ubuntu3.1","8.1-0ubuntu3.2","8.1.1-0ubuntu1","8.1.1-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3-0ubuntu1","9.0.50.20191019-0ubuntu1","9.0.50.20191119-0ubuntu1","9.0.90.20191216-0ubuntu1","9.0.90.20200105-0ubuntu1","9.0.90.20200117-0ubuntu1","9.1-0ubuntu1","9.2-0ubuntu1~20.04","9.2-0ubuntu1~20.04.1","9.2-0ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.1-0ubuntu2","11.1-0ubuntu3","11.2-0ubuntu1","12.0.50.20220217-0ubuntu1","12.0.90-0ubuntu1","12.1-0ubuntu1~22.04","12.1-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.0.50.20230907-0ubuntu1","14.1-0ubuntu1","14.1-0ubuntu2","15.0.50.20240219-0ubuntu1","15.0.50.20240320-0ubuntu1","15.0.50.20240403-0ubuntu1","15.1-1ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.1-2ubuntu1","17.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.3-1ubuntu2","16.3-5ubuntu1","17.1-1ubuntu1","17.1-1ubuntu2","17.1-2ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-123151","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567333","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123151","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f82m-v9ch-rh67"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123151","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-123151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123151","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123151","title":"Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs-\u003ebuf tail","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T16:08:57.397Z","modified":"2026-11-06T08:16:19.006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T09:57:41.639919Z"}],"euvd":[{"id":"EUVD-2026-117575","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T16:08:57Z","modified":"2026-11-06T08:16:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T09:04:28.113071Z"}],"ghsa":[{"id":"GHSA-f82m-v9ch-rh67","title":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a...","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T18:33:15Z","modified":"2026-11-06T00:33:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T00:57:25.690752Z"}],"nvd":[{"id":"CVE-2026-123151","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T17:18:03.35Z","modified":"2026-11-05T22:17:55.72Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-05T23:57:23.655479Z"}],"osv":[{"id":"DEBIAN-CVE-2026-123151","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T17:18:03.35Z","modified":"2026-11-06T23:00:06.559741825Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T23:25:04.562564Z"},{"id":"UBUNTU-CVE-2026-123151","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:46:33.960738749Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"AZL-113131","title":"CVE-2026-123151 affecting package crash 9.0.0-3","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T17:18:03Z","modified":"2026-11-11T14:17:32.127931056Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113158","title":"CVE-2026-123151 affecting package gdb 13.2-11","description":"A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.","status":"published","published":"2026-11-05T17:18:03Z","modified":"2026-11-11T14:17:32.183700589Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}