CVE-2026-121994: Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetchregisterusingp, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
Other sources
Stack buffer overflow in remotetarget::fetchregisterusingp (gdb/remote.c). The function allocates a stack buffer via alloca(registersize) then decodes the stub's p-reply into it with a loop that terminates only on NUL, without bounding writes by registersize. A malicious RSP stub sends an oversized p-reply to overflow the stack buffer and overwrite the saved return address. The same primitive — with a reply shorter than registersize — leaks stack bytes via rawsupply, enabling canary and ASLR disclosure from the same connection.
— Red Hat