Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
Priority LOW 32CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00133 2nd percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 6 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | 16.3-3.1.el10_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8.2-20.1.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 16.3-3.1.el9_8 | Patch available | CNA |
| Red Hat | Red Hat Cost Management On-Premise 1 | — | 1791460851 | Patch available | CNA |
| Red Hat | Red Hat Hardened Images | — | 17.2-6.2.hum1 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1791978534 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1791978528 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1791978528 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1791964013 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1791978693 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 16.3-3.1.el10_2 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8.2-20.1.el8_10 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 16.3-3.1.el9_8 Patch available CNA
- Red Hat Cost Management On-Premise 1 VendorRed Hat Affected — Fixed in 1791460851 Patch available CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in 17.2-6.2.hum1 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1791978534 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1791978528 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1791978528 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1791964013 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1791978693 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:enterprise_linux:10.2 | 10.2 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/a:redhat:cost_management_on_premise:1::el10 | 1 | — | Red Hat |
| cpe:/a:redhat:hummingbird:1 | 1 | — | Red Hat |
| cpe:/a:redhat:rhui:5::el9 | 5 | — | Red Hat |
| cpe:/o:redhat:rhel_els:6 | 6 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
- cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/a:redhat:cost_management_on_premise:1::el10 Versions 1 — ·Red Hat
- cpe:/a:redhat:hummingbird:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:rhui:5::el9 Versions 5 — ·Red Hat
- cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2026:82939 Released 2026-10-14 · Red Hat rating ImportantRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:82447 Released 2026-10-13 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images gdb-17.2-6.2.hum1@aarch64, gdb-17.2-6.2.hum1@s390x, gdb-17.2-6.2.hum1@src +13
- RHSA-2026:79357 Released 2026-10-08 · Red Hat rating ImportantRed Hat Cost Management On-Premise container image update
- Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
Show 3 more Red Hat advisories
- RHSA-2026:73426 Released 2026-09-29 · Red Hat rating Importantgdb security update
- Red Hat Enterprise Linux AppStream (v. 9) gdb-16.3-3.1.el9_8, gdb-doc-16.3-3.1.el9_8, gdb-gdbserver-16.3-3.1.el9_8 +2
- RHSA-2026:73427 Released 2026-09-29 · Red Hat rating Importantgdb security update
- Red Hat Enterprise Linux AppStream (v. 10) gdb-16.3-3.1.el10_2, gdb-doc-16.3-3.1.el10_2, gdb-gdbserver-16.3-3.1.el10_2 +2
- RHSA-2026:73425 Released 2026-09-29 · Red Hat rating Importantgdb security update
- Red Hat Enterprise Linux AppStream (v. 8) gdb-8.2-20.1.el8_10, gdb-doc-8.2-20.1.el8_10, gdb-gdbserver-8.2-20.1.el8_10 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Cost Management On-Premise 1 | Fixed | RHSA-2026:79357 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:73427 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:73425 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:73426 |
| Red Hat Hardened Images | Fixed | RHSA-2026:82447 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:82939 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13732
- 2026-10-03 Alias added: GHSA-j2fm-9w3c-hpj9
- 2026-10-09 Fix available: RHSA-2026:79357 · Red Hat
- 2026-10-09 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
- 2026-10-09 Fix available: costmanagement/costmanagement-ui-rhel10@1791460851 · CNA
- 2026-10-09 1 new reference · CNA
- 2026-10-14 Fix available: RHSA-2026:82447 · Red Hat
- 2026-10-14 Fix available: [email protected] · CNA
- 2026-10-14 1 new reference · CNA
- 2026-10-15 Fix available: rhui5/cds-kubernetes-rhel9@1791978534, rhui5/cds-rhel9@1791978528, rhui5/haproxy-rhel9@1791978528 +2 · CNA
- 2026-10-15 1 new reference · CNA
- 2026-10-16 Fix available: RHSA-2026:82939 · Red Hat
- 2026-10-16 Fix available: Red Hat Hardened Images, Red Hat Update Infrastructure 5 · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-13732 · CVE Program
- CVE-2026-13732 · NVD
- FIRST EPSS
- GHSA-j2fm-9w3c-hpj9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-13732 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences