CVE-2026-121997 Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

High 8.1 Published 5 Nov 2026 Updated 6 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-121997?

CVE-2026-121997 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 5 Nov 2026.

Official description

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.

Weakness: CWE-122

Which versions are affected by CVE-2026-121997?

How do I fix CVE-2026-121997?

No fix has been published for CVE-2026-121997 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-121997 being exploited?

There is no known exploitation of CVE-2026-121997 in the wild and no public exploit code.

Sources

Also known as AZL-113125, AZL-113152, DEBIAN-CVE-2026-121997, GHSA-jq36-9pw3-8r4v, UBUNTU-CVE-2026-121997.