Gdbserver - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gdbserver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 18:25:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGNU GDB: Heap buffer overflow in gdbserver QTDPsrc packet handler (CVE-2026-121997)https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-overflow/Thu, 05 Nov 2026 18:25:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-overflow/A heap buffer overflow in the gdbserver QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution via crafted packet lengths.A heap buffer overflow vulnerability exists in the gdbserver component of the GNU Debugger (GDB) within the 'QTDPsrc' packet handler. The vulnerability is triggered by a discrepancy between the declared source length in a packet and the actual data length provided. This mismatch causes the 'hex2bin' function to perform an out-of-bounds write on the heap, enabling potential remote code execution by an unauthenticated attacker.

Impact

Successful exploitation allows for native code execution in the context of the gdbserver process. The vulnerability does not require authentication.

Recommendation

  • Inventory systems running 'gdbserver' in remote debug configurations.
  • Disable remote 'gdbserver' instances that are exposed to untrusted networks or the public internet.
  • Patch GDB to the version containing the fix for CVE-2026-121997 as soon as the vendor release becomes available.
]]>highadvisoryvulnerabilityrceremote-accessGNU gdbserver: Heap memory information disclosure (CVE-2026-121996)https://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-leak/Thu, 05 Nov 2026 18:23:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gdbserver-heap-leak/A length validation flaw in the gdbserver agent-expression parser allows an unauthenticated remote attacker to perform an out-of-bounds heap read, potentially exposing memory addresses to bypass ASLR or causing a denial of service.CVE-2026-121996 is an out-of-bounds read vulnerability in the GNU gdbserver agent-expression parser. An unauthenticated remote attacker can trigger this flaw to read uninitialized heap memory. The leaked memory contents may contain sensitive addresses, which could be used to defeat Address Space Layout Randomization (ASLR) in subsequent stages of an attack. The flaw can also be triggered repeatedly to induce a denial-of-service state for the gdbserver process.

Impact

The vulnerability enables remote memory disclosure and denial-of-service against targets running gdbserver. Successful exploitation allows an attacker to obtain memory layout details, facilitating further exploitation by bypassing memory protection mechanisms.

Recommendation

  • Inventory all systems running gdbserver to identify exposed instances.
  • Apply patches provided by the GNU project or your distribution maintainer as soon as they become available.
  • Restrict access to gdbserver ports to trusted management IPs using host-based firewalls or network access control lists.
  • Implement monitoring for abnormal gdbserver process behavior, specifically repeated crashes or restarts which may indicate active DoS attempts or exploit testing.
]]>highadvisory