# CVE-2026-121994: GDB stack buffer overflow in remote protocol handler

Source: https://junglewise.ai/threats/cve-2026-121994-a-stack-buffer-overflow-in-the-gdb-client-s-remote-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-121994 · Severity: high · CVSS 8.8 · Published 2026-11-05

GDB is a debugger used by developers to diagnose and fix software problems. A flaw in how GDB handles responses from remote debug targets allows an attacker running a malicious debug target to execute arbitrary code within the developer's GDB process. This could be exploited when a developer connects GDB to a compromised or untrusted debugging target, potentially compromising the developer's system.

Technologies: [Gnu GDB](https://junglewise.ai/threats/technologies/gdb). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-121994 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121994 being exploited in the wild.

**How severe is CVE-2026-121994?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** Gnu GDB <UNKNOWN>.

**Is there a fix for CVE-2026-121994?** No fixed version is recorded yet. Only connect GDB to trusted debug targets; avoid debugging binaries or targets from untrusted sources. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121994 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-121994?** Check whether you run Gnu GDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Only connect GDB to trusted debug targets; avoid debugging binaries or targets from untrusted sources.

## Technical details

A stack buffer overflow exists in the fetch_register_using_p function of GDB's remote protocol handler. When decoding a stub's register reply, the function writes to an alloca-sized buffer without validating the write boundaries against actual register width, allowing buffer overflow. An attacker controlling a remote debug target can craft malicious register replies to trigger the overflow, achieving arbitrary code execution within the GDB process; the self-bootstrapping exploit uses the same mechanism to leak stack canaries and bypass ASLR. User interaction is required (victim must connect GDB and issue register-reading commands).

## Affected products

- GNU GDB <UNKNOWN>

## Timeline

- 2026-11-05: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-121994](https://access.redhat.com/security/cve/CVE-2026-121994)

## Related threats

- [GNU debugger stack buffer overflow in remote target parsing](https://junglewise.ai/threats/cve-2026-123151-a-flaw-was-found-in-the-gnu-debugger-gdb-when-gdb-connects-to-a)
- [GDB out-of-bounds write in STABS parser](https://junglewise.ai/threats/cve-2026-13732-gdb-out-of-bounds-write-in-stabs-parser)