Executive brief
GDB is a widely-used debugger that allows developers to inspect and debug compiled programs. A bug in GDB's STABS debug format parser can be triggered when a user opens a maliciously-crafted binary file and performs normal debugging operations like setting breakpoints. An attacker can exploit this to execute arbitrary commands within the GDB process itself, potentially compromising the developer's workstation or CI/CD pipeline.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) in the read_member_functions() function within gdb/stabsread.c, which parses legacy STABS debug format sections in ELF binaries. The root cause is a linked list removal bug that fails to properly unlink destructor entries while decrementing the list length counter, causing the destructor pointers to remain in the main function list. When this corrupted list is copied to its final allocated array, the out-of-bounds write is triggered. Attack vector is local; an attacker crafts a malicious ELF binary with booby-trapped .stab and .stabstr sections and convinces a user to open it in GDB and perform symbol-inspection operations (e.g., setting a breakpoint). No code execution of the debugged process is required—the vulnerability is in GDB itself. Under controlled conditions, arbitrary command execution within the GDB process has been demonstrated. Patches are expected in GDB 18 (late 2026/2027), which will remove STABS support entirely.
Affected products
- GNU GDB all currently supported versions prior to GDB 18
Timeline
- 2026-08-31: disclosed
- other: GDB 17+ deprecates STABS support; GDB 18 (expected late 2026/2027) will remove STABS entirely