CVE-2026-13732— Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GDB 的 STABS 调试格式解析器中存在一个缺陷。 位于 中的 函数在处理 C++ 类的析构函数与非析构函数成员函数的分离逻辑时，存在一个链表移除错误。该错误导致析构函数条目仍然保留在主函数列表中，同时链表长度计数器却被递减。当函数列表被复制到最终分配的数组时，会引发越界写入。 攻击者可以构造一个包含恶意 和 段的 ELF 二进制文件。当用户在 GDB 中打开该文件并执行任意符号检查操作（例如设置断点）时，即可触发此越界写入。此时目标进程（inferior process）无需实际运行。在受控条件下，已证明该漏
Possible ATT&CK Techniques 1 AI
T1204 · User ExecutionAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13732
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GDB's STABS debug format parser. The
read_member_functions() function in gdb/stabsread.c contains a linked
list removal bug in the code that separates destructor and non-destructor
member functions of C++ classes. The bug causes the destructor entries to
remain in the main function list while the list length counter is
decremented, resulting in an out-of-bounds write when the function list
is copied to its final allocated array. An attacker can craft an ELF
binary with malicious .stab and .stabstr sections that triggers this
out-of-bounds write when a user opens the file in GDB and performs any
symbol-inspection operation such as setting a breakpoint. The inferior
process does not need to be executed. Under controlled conditions, this
was demonstrated to achieve execution of arbitrary commands within the
GDB process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-13732
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13732
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13732 (1)
Other References for CVE-2026-13732 (1)
Same Patch Batch · Red Hat · 2026-08-31 · 6 CVEs total
| CVE-2026-83596 | 8.8 HIGH | Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature |
| CVE-2026-12894 | 8.8 HIGH | Quarkus-qute: io.quarkus.qute.reflectionvalueresolver: quarkus:server-side template inject |
| CVE-2026-17615 | 7.5 HIGH | Resteasy-core: resteasy sourceprovider remote unauthenticated file read |
| CVE-2026-76763 | 7.5 HIGH | Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via larg |
| CVE-2026-81624 | 7.5 HIGH | Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-82327
Libsolv: libsolv: out-of-bounds write in repo_write() via un -
CVE-2026-81893
Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile pa -
CVE-2026-78002
Rsyslog: rsyslog: denial of service via heap buffer overflow -
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-80186
Bluez: stack overflow in name2utf8 causes dos and potential
Same vendor: Red Hat
-
CVE-2026-83596
Webkitgtk: validate the full featurelist array once in opent -
CVE-2026-17615
Resteasy-core: resteasy sourceprovider remote unauthenticate -
CVE-2026-76763
Io.smallrye/smallrye-graphql: smallrye graphql: unauthentica -
CVE-2026-12894
Quarkus-qute: io.quarkus.qute.reflectionvalueresolver: quark -
CVE-2026-81624
Undertow-core: undertow: websocketcontainer defaults for buf
Same weakness: CWE-787
-
CVE-2026-14368
Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON stri -
CVE-2026-82680
D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write -
CVE-2026-58106
Incomplete fix for CVE-2025-40843: safe_strcpy is called wit -
CVE-2026-18393
Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() v -
CVE-2026-78008
Fireware OS Authenticated Buffer Overflow in wgagent
V. Comments for CVE-2026-13732
No comments yet