RHSA-2026:82447HighCVSS 7.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 13, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-13732 →

📋 Description

CVE-2026-13732 — gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF

🎯 Affected products17

  • Red Hat Hardened Images
  • gdb-0:17.2-6.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • gdb-0:17.2-6.2.hum1@s390x as a component of Red Hat Hardened Images
  • gdb-0:17.2-6.2.hum1@src as a component of Red Hat Hardened Images
  • gdb-0:17.2-6.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • gdb-doc-0:17.2-6.2.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • gdb-doc-0:17.2-6.2.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • gdb-doc-0:17.2-6.2.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • gdb-gdbserver-0:17.2-6.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • gdb-gdbserver-0:17.2-6.2.hum1@s390x as a component of Red Hat Hardened Images
  • gdb-gdbserver-0:17.2-6.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • gdb-headless-0:17.2-6.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • gdb-headless-0:17.2-6.2.hum1@s390x as a component of Red Hat Hardened Images
  • gdb-headless-0:17.2-6.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • gdb-minimal-0:17.2-6.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • gdb-minimal-0:17.2-6.2.hum1@s390x as a component of Red Hat Hardened Images
  • gdb-minimal-0:17.2-6.2.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Do not open untrusted or unknown ELF binaries in GDB without first stripping debug sections. Use `objcopy --remove-section=.stab --remove-section=.stabstr <binary>` before debugging. - Use `readelf -S <binary> | grep stab` to check for the presence of STABS sections before opening a binary in GDB. Legitimate modern binaries use DWARF, not STABS. - Consider using LLDB or other debuggers that do not support STABS for analysis of untrusted binaries. - For automated environments (CI, test farms) that invoke GDB on potentially untrusted binaries, run GDB in a sandboxed or containerized environment with restricted filesystem access. - GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected late 2026/2027) will remove STABS support entirely. - GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled binaries from recent GCC versions will not contain STABS data.

🔗 References (5)