Heap Memory Disclosure Vulnerability in gdbserver by Red Hat
CVE-2026-121996

8.2HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
5 November 2026

What is CVE-2026-121996?

A length validation flaw in the agent-expression parser of gdbserver presents a serious risk by allowing unauthenticated remote attackers to access uninitialized heap memory. This could potentially result in denial of service or be leveraged to expose memory addresses that facilitate the bypassing of Address Space Layout Randomization (ASLR), sharpening the threat of further exploitation.

References

https://access.redhat.com/security/cve/CVE-2026-121996
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2565678
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Pulkit Singh Singaria for reporting this issue.
.