CVE-2026-121994

Summary

A stack buffer overflow in GDB's remote protocol handler (fetch_register_using_p) lets a malicious debug target write past a stack-allocated buffer when decoding register replies, enabling arbitrary code execution in the GDB process.

Exploitability

Exploitation requires an attacker-controlled GDB debug target to send a specially crafted register reply packet during a remote debugging session with user interaction (e.g., connecting to a malicious target); no authentication is needed.

Blast radius

Successful exploitation grants full RCE in the GDB process, potentially compromising developer workstations or CI systems where GDB is used for debugging untrusted binaries.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GDB version 15.2 or later, as this version includes the fix for CVE-2026-121994.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.