CVE-2026-13732

Full vulnerability record from the local CVENow database.

Description

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Severity

HIGH

CVSS score

7.0 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-31 20:17:02.180000

Last modified

2026-11-04 22:17:58.717000

View original CVE JSON

{
  "id": "CVE-2026-13732",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-31T20:17:02.180",
  "lastModified": "2026-11-04T22:17:58.717",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in GDB's STABS debug format parser. The\nread_member_functions() function in gdb/stabsread.c contains a linked\nlist removal bug in the code that separates destructor and non-destructor\nmember functions of C++ classes. The bug causes the destructor entries to\nremain in the main function list while the list length counter is\ndecremented, resulting in an out-of-bounds write when the function list\nis copied to its final allocated array. An attacker can craft an ELF\nbinary with malicious .stab and .stabstr sections that triggers this\nout-of-bounds write when a user opens the file in GDB and performs any\nsymbol-inspection operation such as setting a breakpoint. The inferior\nprocess does not need to be executed. Under controlled conditions, this\nwas demonstrated to achieve execution of arbitrary commands within the\nGDB process."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gdb",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "versions": [
            {
              "version": "0:16.3-3.1.el10_2",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gdb",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "versions": [
            {
              "version": "0:8.2-20.1.el8_10",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gdb",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "versions": [
            {
              "version": "0:16.3-3.1.el9_8",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Cost Management On-Premise 1",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "costmanagement/costmanagement-ui-rhel10",
          "cpes": [
            "cpe:/a:redhat:cost_management_on_premise:1::el10"
          ],
          "versions": [
            {
              "version": "1791460851",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "gdb-main",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "versions": [
            {
              "version": "17.2-6.2.hum1",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhui5/cds-kubernetes-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "versions": [
            {
              "version": "1791978534",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhui5/cds-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "versions": [
            {
              "version": "1791978528",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhui5/haproxy-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "versions": [
            {
              "version": "1791978528",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhui5/installer-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "versions": [
            {
              "version": "1791964013",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Update Infrastructure 5",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhui5/rhua-rhel9",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "versions": [
            {
              "version": "1791978693",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gdb",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gdb",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-01T14:33:22.469791Z",
          "id": "CVE-2026-13732",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:73425",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:73426",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:73427",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:79357",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:82447",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:82939",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-13732",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494416",
      "source": "[email protected]"
    }
  ]
}