DEBIAN-CVE-2026-121996: Debian/gdb vulnerability

Published Nov 5, 2026

Updated

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.

Affected Software

3 affected components

debian/gdb*

Event History

Nov 5, 2026

CVE Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Deployments running gdbserver that are reachable by an unauthenticated remote attacker are exposed. The issue is in gdbserver's agent-expression parser, not described as affecting unrelated GDB components.

What can an attacker do after reaching the affected service?

An unauthenticated remote attacker can trigger disclosure of uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap data may include addresses that help defeat ASLR during further exploitation.

What can be done while a fix is unavailable?

Restrict network access to gdbserver so unauthenticated remote attackers cannot reach it. The provided data does not identify a configuration-based mitigation beyond limiting exposure.

DEBIAN-CVE-2026-121996: Debian/gdb vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What can an attacker do after reaching the affected service?

What can be done while a fix is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What can an attacker do after reaching the affected service?

What can be done while a fix is unavailable?