A flaw in GDB’s STABS parser allows an out‑of‑bounds write during the processing of the read_member_functions() routine. The vulnerability is triggered when a user loads an ELF binary containing malicious .stab and .stabstr sections, causing an out‑of‑bounds overwrite of adjacent memory that can be leveraged to execute arbitrary commands inside the GDB process. This defect is a classic buffer overflow (CWE‑787) and can be triggered by simple debugging actions such as setting a breakpoint, without needing to run the inferior program.

The issue affects systems that ship GDB with STABS support on Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. All RHEL releases that include a GDB version that still parses STABS data are vulnerable; the specific GDB version is not listed, but the vulnerability persists until GDB 18, which is expected to drop STABS parsing altogether. Any system running GDB 17 or earlier that debugs untrusted ELF files containing STABS sections is therefore at risk.

The CVSS score of 7.8 indicates a high severity, but EPSS data is unavailable and the vulnerability is not yet listed in CISA KEV, suggesting no widespread exploitation. The attack vector is local: an attacker must cause a user or an automated system to start GDB with a crafted ELF file. Because routine debugging operations trigger the flaw, a local attacker can hijack the debugger process to run arbitrary commands, potentially escalating privileges or pivoting to other vulnerabilities. Until a vendor patch is released, mitigation requires updating GDB to a version that no longer supports STABS or avoiding debugging untrusted binaries.