CVE-2026-121997: Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.
Other sources
Heap buffer overflow in cmdqtdpsrc (gdbserver/tracepoint.cc). The function allocates xmalloc(slen+1) sized by the packet's declared slen field, but calls hex2bin(packet, src, strlen(packet)/2) using the actual hex data length independently. When actual data exceeds declared slen, hex2bin overflows the heap buffer by the difference with attacker-controlled content. Demonstrated exploitation: overflow corrupts processinfoprivate::threaddb, replacing the tdtamaplwp2thrp function pointer with an attacker-chosen address. A subsequent qGetTLSAddr packet causes gdbserver to call through the forged pointer, achieving RIP control and native code execution.
— Red Hat