CVE-2026-13732

The GNU Debugger (GDB) contains an out-of-bounds write (CWE-787) in its legacy STABS debug format parser: the read_member_functions() function in gdb/stabsread.c mishandles removal of destructor entries from a linked list of C++ class member functions, leaving destructor entries in the list while its length counter is decremented, which corrupts memory when the list is copied into its final allocated array. An attacker triggers it by crafting an ELF binary with malicious .stab and .stabstr sections; the bug fires when a user opens that file in GDB and performs any symbol-inspection operation such as setting a breakpoint, and the target program does not need to be executed. Under controlled conditions the flaw was demonstrated to achieve execution of arbitrary commands within the GDB process, so an attacker who can get a crafted binary opened by a victim gains code execution on that machine with the victim's privileges. Affected users are developers, reverse engineers, malware analysts, and automated pipelines that inspect third-party or untrusted ELF files with GDB; the advisory data does not specify affected or fixed version numbers. No in-the-wild exploitation, public proof-of-concept, or CISA KEV listing is known, and EPSS assigns only a 0.1% 30-day exploitation probability (2nd percentile), consistent with the local (AV:L), high-complexity, user-interaction-dependent (UI:R) attack path.

What to do: Until a patched gdb package is available from your distribution or vendor (Red Hat is the CNA, and no fixed version is given in this data), avoid opening untrusted or attacker-supplied ELF binaries in GDB and monitor vendor advisories to upgrade as soon as the fix ships. Note that the trigger requires no execution of the target - merely opening the file and any symbol-inspection action such as setting a breakpoint - so not running the binary is not protection; files containing only DWARF and no .stab/.stabstr sections bypass the vulnerable path, but attackers can deliberately include STABS sections, so do not rely on modern default DWARF output as a defense. If third-party ELF inspection is unavoidable, perform it on a fully updated system or with non-GDB tooling, and check your exposure…