CVE-2026-13732: Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
A flaw was found in GDB's STABS debug format parser. The readmemberfunctions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
Other sources
A flaw was found in the GDB STABS debug format parser. The readmemberfunctions() function in gdb/stabsread.c processes C++ member function lists from STABS symbol data. When a class contains both destructor and non-destructor member functions, the code at lines 5086-5131 attempts to separate them into two lists. However, the linked list removal logic has a bug: the lastsublist tracking variable is updated to point to REMOVED destructor nodes instead of the previous retained node, and the continue path for non-destructor nodes does not update lastsublist at all. This causes destructor entries to remain in the sublist linked list while the length variable is decremented by hasdestructor. In the subsequent copy loop (lines 5163-5166), the allocated array has length elements but the loop iterates over all remaining sublist entries (more than length). The loop index i starts at length and decrements, going negative, causing writes before the allocated obstack array. The written data consists of struct fnfield members controlled by the attacker through crafted STABS strings. The obstack underflow can corrupt chunk metadata including function pointers, which are called on subsequent obstack operations, resulting in arbitrary code execution. The vulnerability triggers automatically when GDB expands partial symbol tables — any symbol-inspection command (break, ptype, info functions) on a binary containing crafted .stab/.stabstr sections is sufficient. The inferior process does not need to be executed.
Upstream: https://sourceware.org/git/binutils-gdb.git Affected: gdb/stabsread.c (readmemberfunctions, lines 5086-5166) Confirmed on: GDB 16.3-1, Debian trixie, x86-64, glibc 2.41 Reporter: JD Marsters (Bhut Red)
— Red Hat
Gdb: gdb: out-of-bounds write in stabs parser readmemberfunctions() via crafted elf
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gdbto a version that resolves this vulnerability.Fixed in 16.3-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who open attacker-controlled ELF binaries in GNU GDB are exposed if the files contain crafted .stab and .stabstr sections. The issue is triggered during symbol inspection, including actions such as setting a breakpoint.
Does the target program need to run for exploitation to occur?
No. The inferior process does not need to be executed; opening the crafted file in GDB and performing a symbol-inspection operation is sufficient.
What level of access does an attacker need?
An attacker needs to convince a user to open a malicious ELF file in GDB and perform a symbol-inspection action. The provided data states that, under controlled conditions, this can lead to arbitrary command execution within the GDB process.