RHSA-2026:96098: Important: gdb security update
The GNU Debugger (GDB) allows users to debug programs written in various programming languages including C, C++, and Fortran. Security Fix(es): gdb: gdb: Out-of-bounds write in STABS parser readmemberfunctions() via crafted ELF (CVE-2026-13732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gdbto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdb-debuginfoto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdb-debugsourceto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdb-docto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdb-gdbserverto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdb-headlessto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdb-minimalto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0 - Upgrade
Upgrade
redhat/gdbto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0.aa - Upgrade
Upgrade
redhat/gdb-debuginfoto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0.aa - Upgrade
Upgrade
redhat/gdb-debugsourceto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0.aa - Upgrade
Upgrade
redhat/gdb-gdbserverto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0.aa - Upgrade
Upgrade
redhat/gdb-headlessto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0.aa - Upgrade
Upgrade
redhat/gdb-minimalto a version that resolves this vulnerability.Fixed in 14.2-4.3.el10_0.aa
Event History
Frequently Asked Questions
Which GDB package variants are included in this update?
The update covers redhat/gdb, redhat/gdb-debuginfo, redhat/gdb-debugsource, redhat/gdb-gdbserver, redhat/gdb-headless, redhat/gdb-minimal, and redhat/gdb-doc.
What type of file should be treated as potentially malicious during debugging?
A crafted ELF file can trigger the out-of-bounds write while GDB parses STABS member-function information in read_member_functions().