RHSA-2026:96097: Important: gdb security update

Q: What must an attacker control to trigger this issue?

The issue is triggered through a crafted ELF file that reaches GDB's STABS parser, specifically the read_member_functions() code path. Systems are most relevantly exposed when GDB processes ELF files from untrusted sources.

Q: Which GDB-related packages are included in this update?

The advisory lists redhat/gdb, redhat/gdb-debuginfo, redhat/gdb-debugsource, redhat/gdb-gdbserver, redhat/gdb-headless, redhat/gdb-minimal, and redhat/gdb-doc. This includes GDB server, headless, and minimal package variants.

Q: How can I determine whether my environment needs review?

Check whether any of the listed GDB packages are installed and whether users or automated workflows open or inspect ELF files obtained from untrusted sources. The provided data does not include affected or fixed package versions.

Published Nov 9, 2026

Updated

The GNU Debugger (GDB) allows users to debug programs written in various programming languages including C, C++, and Fortran. Security Fix(es): gdb: gdb: Out-of-bounds write in STABS parser readmemberfunctions() via crafted ELF (CVE-2026-13732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

25 affected componentsFixes available

redhat/gdb<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-debuginfo<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-debugsource<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-doc<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-gdbserver<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-headless<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-minimal<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-debuginfo<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-debugsource<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-gdbserver<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-headless<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-minimal<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-debuginfo<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-debugsource<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-gdbserver<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-headless<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb-minimal<14.2-4.2.el9_6

14.2-4.2.el9_6

redhat/gdb<14.2-4.2.el9_6.aa

14.2-4.2.el9_6.aa

redhat/gdb-debuginfo<14.2-4.2.el9_6.aa

14.2-4.2.el9_6.aa

redhat/gdb-debugsource<14.2-4.2.el9_6.aa

14.2-4.2.el9_6.aa

redhat/gdb-gdbserver<14.2-4.2.el9_6.aa

14.2-4.2.el9_6.aa

redhat/gdb-headless<14.2-4.2.el9_6.aa

14.2-4.2.el9_6.aa

redhat/gdb-minimal<14.2-4.2.el9_6.aa

14.2-4.2.el9_6.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/gdb to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb-debuginfo to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb-debugsource to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb-doc to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb-gdbserver to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb-headless to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb-minimal to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6
Upgrade
Upgrade redhat/gdb to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6.aa
Upgrade
Upgrade redhat/gdb-debuginfo to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6.aa
Upgrade
Upgrade redhat/gdb-debugsource to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6.aa
Upgrade
Upgrade redhat/gdb-gdbserver to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6.aa
Upgrade
Upgrade redhat/gdb-headless to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6.aa
Upgrade
Upgrade redhat/gdb-minimal to a version that resolves this vulnerability.
Fixed in 14.2-4.2.el9_6.aa

Event History

Nov 9, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What must an attacker control to trigger this issue?

The issue is triggered through a crafted ELF file that reaches GDB's STABS parser, specifically the read_member_functions() code path. Systems are most relevantly exposed when GDB processes ELF files from untrusted sources.

Which GDB-related packages are included in this update?

The advisory lists redhat/gdb, redhat/gdb-debuginfo, redhat/gdb-debugsource, redhat/gdb-gdbserver, redhat/gdb-headless, redhat/gdb-minimal, and redhat/gdb-doc. This includes GDB server, headless, and minimal package variants.

How can I determine whether my environment needs review?

Check whether any of the listed GDB packages are installed and whether users or automated workflows open or inspect ELF files obtained from untrusted sources. The provided data does not include affected or fixed package versions.

RHSA-2026:96097: Important: gdb security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to trigger this issue?

Which GDB-related packages are included in this update?

How can I determine whether my environment needs review?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to trigger this issue?

Which GDB-related packages are included in this update?

How can I determine whether my environment needs review?