High [CVE-2026-13732] Gdb: gdb: out-of-bounds write in stabs parser read_member_functions via crafted elf
This high-severity Red Hat Linux advisory covers CVE-2026-13732 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes.
The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array.
An attacker can craft an ELF binary with malicious.stab and.stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed.
Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process. While GCC removed STABS emitting support in GCC 13 and GDB deprecated STABS parsing in GDB 17, all deployed GDB versions parse STABS data without user opt-in.
An attacker can embed STABS sections in any ELF binary, including one compiled with DWARF debug information, and GDB will parse both. The vulnerability requires the user to open the crafted binary in GDB and issue a symbol-inspection command, which is normal GDB usage.
Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-787.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- The following practices would help for avoiding exposure and mitigate this flaw: - Do not open untrusted or unknown ELF binaries in GDB without first stripping debug sections. Use `objcopy --remove-section=.stab --remove-section=.stabstr <binary>` before debugging. - Use `readelf -S <binary> | grep stab` to check for the presence of STABS sections before opening a binary in GDB. Legitimate modern binaries use DWARF, not STABS. - Consider using LLDB or other debuggers that do not support STABS for analysis of untrusted binaries. - For automated environments (CI, test farms) that invoke GDB on potentially untrusted binaries, run GDB in a sandboxed or containerized environment with restricted filesystem access. - GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected late 2026/2027) will remove STABS support entirely. - GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled binaries from recent GCC versions will not contain STABS data.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.