RHSA-2026:73427HighCVSS 7.0

Red Hat Security Advisory: gdb security update

Published
September 29, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-13732 →

📋 Description

CVE-2026-13732 — gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF

🎯 Affected products27

  • Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-0:16.3-3.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-0:16.3-3.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-0:16.3-3.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-0:16.3-3.1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-0:16.3-3.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debuginfo-0:16.3-3.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debuginfo-0:16.3-3.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debuginfo-0:16.3-3.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debuginfo-0:16.3-3.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debugsource-0:16.3-3.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debugsource-0:16.3-3.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debugsource-0:16.3-3.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-debugsource-0:16.3-3.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-doc-0:16.3-3.1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-gdbserver-0:16.3-3.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-gdbserver-0:16.3-3.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-gdbserver-0:16.3-3.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-gdbserver-0:16.3-3.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-headless-0:16.3-3.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-headless-0:16.3-3.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-headless-0:16.3-3.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-headless-0:16.3-3.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-minimal-0:16.3-3.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-minimal-0:16.3-3.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-minimal-0:16.3-3.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gdb-minimal-0:16.3-3.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Do not open untrusted or unknown ELF binaries in GDB without first stripping debug sections. Use `objcopy --remove-section=.stab --remove-section=.stabstr <binary>` before debugging. - Use `readelf -S <binary> | grep stab` to check for the presence of STABS sections before opening a binary in GDB. Legitimate modern binaries use DWARF, not STABS. - Consider using LLDB or other debuggers that do not support STABS for analysis of untrusted binaries. - For automated environments (CI, test farms) that invoke GDB on potentially untrusted binaries, run GDB in a sandboxed or containerized environment with restricted filesystem access. - GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected late 2026/2027) will remove STABS support entirely. - GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled binaries from recent GCC versions will not contain STABS data.

🔗 References (3)