CVE-2026-13732
Received Received - Intake

Out-of-Bounds Write in GDB STABS Debug Format Parser

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-09-01
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-13732
EUVD
EUVD-2026-68746

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gnu gdb *
gnu gdb 16.3-1
gnu gdb From 16.3-1 (inc) to 17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds write vulnerability in GDB's STABS debug format parser. The flaw occurs in the read_member_functions() function where a linked list removal bug causes destructor entries to remain in the main function list while the list length counter is incorrectly decremented. This leads to an out-of-bounds write when copying the function list to a final array. Attackers can exploit this by crafting malicious ELF binaries with harmful .stab and .stabstr sections. When a user opens such a file in GDB and performs symbol-inspection operations like setting a breakpoint, the vulnerability triggers without needing to execute the inferior process.

Detection Guidance

To detect this vulnerability, check for STABS debug sections in ELF binaries using the command: readelf -S <binary> | grep stab. If STABS sections (.stab or .stabstr) are present, the binary may be malicious. Also monitor GDB processes for unexpected behavior during symbol-inspection operations.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary commands within the GDB process. If you open a specially crafted ELF binary in GDB and perform any symbol-inspection operation, an attacker could gain control over your system. The attack does not require executing the binary itself, only opening it in GDB. This could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in GDB's STABS debug format parser that could allow arbitrary code execution when processing malicious ELF binaries. Compliance impacts would only occur if such an attack led to unauthorized data access or system compromise in a regulated environment.

Mitigation Strategies

Strip STABS sections from untrusted binaries using objcopy --remove-section=.stab --remove-section=.stabstr <binary>. Avoid opening untrusted ELF files in GDB. Use debuggers like LLDB that do not support STABS. Run GDB in sandboxed environments for automated tasks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13732. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart