CVE-2026-121997Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Description

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.

Timeline

Scores

EPSS (exploitation in 30 days)

0.71% · top 46% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 10

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 6

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 9

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 9

  All versions: affected

• Red Hat · Red Hat Hardened Images

  All versions: affected

What to do

Workaround: There is no mitigation for this vulnerability. gdbserver has no authentication mechanism; exposure is limited only by network access to the gdbserver port. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to restrict network access and block exposure of gdbserver listening ports to untrusted networks: upgrade to the corresponding fixed Red Hat builds, which apply the documented input check, closing all 2 injection vectors (malformed QTDPsrc packet with declared length smaller than payload length, qGetTLSAddr packet to invoke corrupted function pointer). Until patched, this is a concern on Linux systems running gdbserver with reachable listening ports, so restrict network access to exposed gdbserver ports via firewalls or network filtering, as gdbserver has no built-in authentication. As a compensating measure, Enable ASLR to randomize memory layout and hinder predicting target addresses to overwrite function pointers, Run SELinux in enforcing mode to confine gdbserver to a least-privilege domain, Isolate gdbserver within dedicated user, PID, network, and mount namespaces to restrict post-compromise impact, and Drop unnecessary POSIX capabilities from the gdbserver process bounding set to restrict privilege. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap buffer overflow defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-117574 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-121997](https://cveledger.app/badge/CVE-2026-121997.svg)](https://cveledger.app/cve/CVE-2026-121997)

Record last updated 6 Nov 2026, 19:55 UTC.