Quick answers
- Is CVE-2026-121994 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121994 being exploited in the wild.
- How severe is CVE-2026-121994?
- High severity, with a CVSS score of 8.8, published 5 November 2026.
- Which products and versions are affected?
- Gnu GDB <UNKNOWN>.
- Is there a fix for CVE-2026-121994?
- No fixed version is recorded yet. Only connect GDB to trusted debug targets; avoid debugging binaries or targets from untrusted sources. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-121994 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-121994?
- Check whether you run Gnu GDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Only connect GDB to trusted debug targets; avoid debugging binaries or targets from untrusted sources.
Technical details
A stack buffer overflow exists in the fetch_register_using_p function of GDB's remote protocol handler. When decoding a stub's register reply, the function writes to an alloca-sized buffer without validating the write boundaries against actual register width, allowing buffer overflow. An attacker controlling a remote debug target can craft malicious register replies to trigger the overflow, achieving arbitrary code execution within the GDB process; the self-bootstrapping exploit uses the same mechanism to leak stack canaries and bypass ASLR. User interaction is required (victim must connect GDB and issue register-reading commands).
Affected products
- GNU GDB <UNKNOWN>
Timeline
- 2026-11-05: disclosed