Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by redhat

CVE-2026-13732Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

High 7.0

In plain English

A high-severity out-of-bounds write in Red Hat Cost Management On-Premise 1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 97.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10gdb16.3-3.1.el10_2ALSA-2026:73427
AlmaLinux:8gdb8.2-20.1.el8_10ALSA-2026:73425
AlmaLinux:9gdb16.3-3.1.el9_8ALSA-2026:73426
AlmaLinux:10gdb-doc16.3-3.1.el10_2ALSA-2026:73427
AlmaLinux:8gdb-doc8.2-20.1.el8_10ALSA-2026:73425
AlmaLinux:9gdb-doc16.3-3.1.el9_8ALSA-2026:73426
AlmaLinux:10gdb-gdbserver16.3-3.1.el10_2ALSA-2026:73427
AlmaLinux:8gdb-gdbserver8.2-20.1.el8_10ALSA-2026:73425
AlmaLinux:9gdb-gdbserver16.3-3.1.el9_8ALSA-2026:73426
AlmaLinux:10gdb-headless16.3-3.1.el10_2ALSA-2026:73427
AlmaLinux:8gdb-headless8.2-20.1.el8_10ALSA-2026:73425
AlmaLinux:9gdb-headless16.3-3.1.el9_8ALSA-2026:73426
AlmaLinux:10gdb-minimal16.3-3.1.el10_2ALSA-2026:73427
AlmaLinux:9gdb-minimal16.3-3.1.el9_8ALSA-2026:73426
Debian:12gdbno fix listedDEBIAN-CVE-2026-13732
Debian:13gdbno fix listedDEBIAN-CVE-2026-13732
Debian:14gdbno fix listedDEBIAN-CVE-2026-13732
Rocky Linux:10gdb0:16.3-3.1.el10_2RLSA-2026:73427
Rocky Linux:8gdb0:8.2-20.1.el8_10RLSA-2026:73425
Rocky Linux:9gdb0:16.3-3.1.el9_8RLSA-2026:73426
Ubuntu:22.04:LTSgdbno fix listedUBUNTU-CVE-2026-13732
Ubuntu:24.04:LTSgdbno fix listedUBUNTU-CVE-2026-13732
Ubuntu:26.04:LTSgdbno fix listedUBUNTU-CVE-2026-13732
Ubuntu:26.10gdbno fix listedUBUNTU-CVE-2026-13732

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Cost Management On-Premise 1 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References