Bug 2565676 (CVE-2026-121994)

Summary: CVE-2026-121994 gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 10:03:04 UTC 
Stack buffer overflow in remote_target::fetch_register_using_p (gdb/remote.c). The function allocates a stack buffer via alloca(register_size) then decodes the stub's p-reply into it with a loop that terminates only on NUL, without bounding writes by register_size. A malicious RSP stub sends an oversized p-reply to overflow the stack buffer and overwrite the saved return address. The same primitive — with a reply shorter than register_size — leaks stack bytes via raw_supply, enabling canary and ASLR disclosure from the same connection.