Affected: AlmaLinux:8: gdb, AlmaLinux:8: gdb-doc, AlmaLinux:8: gdb-gdbserver, AlmaLinux:8: gdb-headless

The GNU Debugger (GDB) allows debugging programs written in C, C++, Java, and other languages by executing them in a controlled fashion and then printing their data.

Security Fix(es):

* gdb: STABS debug format parser out-of-bounds write via crafted ELF binary (CVE-2026-13732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: gdb, Alpaquita:25: gdb, Alpaquita:stream: gdb, BellSoft Hardened Containers:23: gdb, BellSoft Hardened Containers:25: gdb, BellSoft Hardened Containers:stream: gdb

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Security update for gdb

Affected: Rocky Linux:8: gdb

The GNU Debugger (GDB) allows debugging programs written in C, C++, Java, and other languages by executing them in a controlled fashion and then printing their data.

Security Fix(es):

* gdb: STABS debug format parser out-of-bounds write via crafted ELF binary (CVE-2026-13732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for gdb

Affected: Ubuntu:Pro:16.04:LTS: gdb, Ubuntu:Pro:18.04:LTS: gdb, Ubuntu:20.04:LTS: gdb, Ubuntu:22.04:LTS: gdb, Ubuntu:24.04:LTS: gdb, Ubuntu:26.04:LTS: gdb

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.