CVE-2026-121996: Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.
Other sources
Length validation flaw in gdbparseagentexpr (gdbserver/ax.cc). The function trusts the attacker-declared xlen unconditionally: xmalloc(xlen) allocates the buffer and aexpr->length is set to xlen, but hex2bin stops at the packet terminator if actual data is shorter, leaving the buffer tail uninitialized. Additionally, actparm is advanced by xlen2 regardless of actual data length, producing a wild pointer the caller dereferences. Two confirmed impacts: (1) gdbserver echoes uninitialized heap bytes back to the client, disclosing heap addresses for ASLR bypass; (2) deterministic crash via wild pointer when declared length greatly exceeds actual data.
— Red Hat