CVE-2026-121997

CVSS 8.1 (high) · published 2026-11-05

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.

Weakness: CWE-122

Source: NVD CVE-2026-121997

References

• https://access.redhat.com/security/cve/CVE-2026-121997
• https://bugzilla.redhat.com/show_bug.cgi?id=2565679

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.