GNU GDB: Heap buffer overflow in gdbserver QTDPsrc packet handler (CVE-2026-121997)
A heap buffer overflow in the gdbserver QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution via crafted packet lengths.
CVE search metadata
CVE search record: CVE-2026-121997. Severity: high. CVSS: 8.1. KEV: no. Product: gdbserver. Brief: GNU GDB: Heap buffer overflow in gdbserver QTDPsrc packet handler (CVE-2026-121997). Brief link: https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-overflow/
Triage facts
Revision 1- Applicability
- gdbserver
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 18:25 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A heap buffer overflow vulnerability exists in the gdbserver component of the GNU Debugger (GDB) within the 'QTDPsrc' packet handler. The vulnerability is triggered by a discrepancy between the declared source length in a packet and the actual data length provided. This mismatch causes the 'hex2bin' function to perform an out-of-bounds write on the heap, enabling potential remote code execution by an unauthenticated attacker.
Impact
Successful exploitation allows for native code execution in the context of the gdbserver process. The vulnerability does not require authentication.
Recommendation
- Inventory systems running 'gdbserver' in remote debug configurations.
- Disable remote 'gdbserver' instances that are exposed to untrusted networks or the public internet.
- Patch GDB to the version containing the fix for CVE-2026-121997 as soon as the vendor release becomes available.
Immediate actions
Identify and restrict access to exposed gdbserver network ports
Threat Hunt
Hunt for anomalous remote connections to ports used by gdbserver
Data: Network connection logs (Netflow/PCAP/Firewall)
Mitigations
Apply vendor patches to GDB once available
CVE-2026-121997