CVE-2026-13732

Name of the Vulnerable Software and Affected Versions GDB (affected versions not specified)

Description A flaw exists in the STABS debug format parser within the read member functions() function in gdb/stabsread.c. The issue stems from a linked list removal bug during the separation of destructor and non-destructor member functions of C++ classes. This causes destructor entries to persist in the main function list while the length counter is decremented, leading to an out-of-bounds write when the list is copied to its final allocated array. An attacker can exploit this by crafting an ELF binary with malicious .stab and .stabstr sections. The flaw is triggered when a user opens the file and performs symbol-inspection operations, such as setting a breakpoint, without needing to execute the inferior process. This can lead to the execution of arbitrary commands within the GDB process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.