{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gdbserver/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gnu:gdb:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-121997"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gdbserver"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","remote-access"],"_cs_type":"advisory","_cs_vendors":["GNU"],"content_html":"\u003cp\u003eA heap buffer overflow vulnerability exists in the gdbserver component of the GNU Debugger (GDB) within the 'QTDPsrc' packet handler. The vulnerability is triggered by a discrepancy between the declared source length in a packet and the actual data length provided. This mismatch causes the 'hex2bin' function to perform an out-of-bounds write on the heap, enabling potential remote code execution by an unauthenticated attacker.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for native code execution in the context of the gdbserver process. The vulnerability does not require authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems running 'gdbserver' in remote debug configurations.\u003c/li\u003e\n\u003cli\u003eDisable remote 'gdbserver' instances that are exposed to untrusted networks or the public internet.\u003c/li\u003e\n\u003cli\u003ePatch GDB to the version containing the fix for CVE-2026-121997 as soon as the vendor release becomes available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T18:25:27Z","date_published":"2026-11-05T18:25:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-overflow/","summary":"A heap buffer overflow in the gdbserver QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution via crafted packet lengths.","title":"GNU GDB: Heap buffer overflow in gdbserver QTDPsrc packet handler (CVE-2026-121997)","url":"https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gnu:gdb:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-121996"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gdbserver"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GNU"],"content_html":"\u003cp\u003eCVE-2026-121996 is an out-of-bounds read vulnerability in the GNU gdbserver agent-expression parser. An unauthenticated remote attacker can trigger this flaw to read uninitialized heap memory. The leaked memory contents may contain sensitive addresses, which could be used to defeat Address Space Layout Randomization (ASLR) in subsequent stages of an attack. The flaw can also be triggered repeatedly to induce a denial-of-service state for the gdbserver process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability enables remote memory disclosure and denial-of-service against targets running gdbserver. Successful exploitation allows an attacker to obtain memory layout details, facilitating further exploitation by bypassing memory protection mechanisms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running gdbserver to identify exposed instances.\u003c/li\u003e\n\u003cli\u003eApply patches provided by the GNU project or your distribution maintainer as soon as they become available.\u003c/li\u003e\n\u003cli\u003eRestrict access to gdbserver ports to trusted management IPs using host-based firewalls or network access control lists.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for abnormal gdbserver process behavior, specifically repeated crashes or restarts which may indicate active DoS attempts or exploit testing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T18:23:28Z","date_published":"2026-11-05T18:23:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-leak/","summary":"A length validation flaw in the gdbserver agent-expression parser allows an unauthenticated remote attacker to perform an out-of-bounds heap read, potentially exposing memory addresses to bypass ASLR or causing a denial of service.","title":"GNU gdbserver: Heap memory information disclosure (CVE-2026-121996)","url":"https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Gdbserver","version":"https://jsonfeed.org/version/1.1"}