CVE-2026-13732 Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
An attacker can execute arbitrary code in GDB by tricking a user into opening a crafted ELF binary with malicious STABS sections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-13732?
CVE-2026-13732 is a high-severity memory corruption vulnerability in Red Hat Cost Management On-Premise 1, published on 31 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
Weakness: CWE-787
Which versions are affected by CVE-2026-13732?
Linux distribution packages (40)
gdb AlmaLinux:10 | All versions | 16.3-3.1.el10_2 |
gdb-doc AlmaLinux:10 | All versions | 16.3-3.1.el10_2 |
gdb-gdbserver AlmaLinux:10 | All versions | 16.3-3.1.el10_2 |
gdb-headless AlmaLinux:10 | All versions | 16.3-3.1.el10_2 |
gdb-minimal AlmaLinux:10 | All versions | 16.3-3.1.el10_2 |
gdb AlmaLinux:8 | All versions | 8.2-20.1.el8_10 |
gdb-doc AlmaLinux:8 | All versions | 8.2-20.1.el8_10 |
gdb-gdbserver AlmaLinux:8 | All versions | 8.2-20.1.el8_10 |
gdb-headless AlmaLinux:8 | All versions | 8.2-20.1.el8_10 |
gdb AlmaLinux:9 | All versions | 16.3-3.1.el9_8 |
gdb-doc AlmaLinux:9 | All versions | 16.3-3.1.el9_8 |
gdb-gdbserver AlmaLinux:9 | All versions | 16.3-3.1.el9_8 |
gdb-headless AlmaLinux:9 | All versions | 16.3-3.1.el9_8 |
gdb-minimal AlmaLinux:9 | All versions | 16.3-3.1.el9_8 |
gdb Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb-doc Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb-gdbserver Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb-headless Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb-minimal Red Hat:enterprise_linux:10.2 | All versions | 0:16.3-3.1.el10_2 |
gdb Red Hat:enterprise_linux:8::appstream | All versions | 0:8.2-20.1.el8_10 |
gdb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.2-20.1.el8_10 |
gdb-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:8.2-20.1.el8_10 |
gdb-doc Red Hat:enterprise_linux:8::appstream | All versions | 0:8.2-20.1.el8_10 |
gdb-gdbserver Red Hat:enterprise_linux:8::appstream | All versions | 0:8.2-20.1.el8_10 |
gdb-headless Red Hat:enterprise_linux:8::appstream | All versions | 0:8.2-20.1.el8_10 |
gdb Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb-doc Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb-gdbserver Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb-headless Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb-minimal Red Hat:enterprise_linux:9::appstream | All versions | 0:16.3-3.1.el9_8 |
gdb Red Hat:hummingbird:1 | All versions | 0:17.2-6.2.hum1 |
gdb-doc Red Hat:hummingbird:1 | All versions | 0:17.2-6.2.hum1 |
gdb-gdbserver Red Hat:hummingbird:1 | All versions | 0:17.2-6.2.hum1 |
gdb-headless Red Hat:hummingbird:1 | All versions | 0:17.2-6.2.hum1 |
gdb-minimal Red Hat:hummingbird:1 | All versions | 0:17.2-6.2.hum1 |
gdb Rocky Linux:10 | All versions | 0:16.3-3.1.el10_2 |
How do I fix CVE-2026-13732?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-13732 being exploited?
There is no known exploitation of CVE-2026-13732 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:73425, ALSA-2026:73426, ALSA-2026:73427, AZL-98547, AZL-98550, BELL-CVE-2026-13732 and 20 more.