{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "An update for gdb is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "The GNU Debugger (GDB) allows users to debug programs written in various programming languages including C, C++, and Fortran. \n\nSecurity Fix(es):\n\n* gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF (CVE-2026-13732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:96096",
      "url" : "https://access.redhat.com/errata/RHSA-2026:96096"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/#important",
      "url" : "https://access.redhat.com/security/updates/classification/#important"
    }, {
      "category" : "external",
      "summary" : "2494416",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2494416"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96096.json"
    } ],
    "title" : "Red Hat Security Advisory: gdb security update",
    "tracking" : {
      "current_release_date" : "2026-11-09T09:49:09+00:00",
      "generator" : {
        "date" : "2026-11-09T09:49:09+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.5"
        }
      },
      "id" : "RHSA-2026:96096",
      "initial_release_date" : "2026-11-09T02:49:48+00:00",
      "revision_history" : [ {
        "date" : "2026-11-09T02:49:48+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-11-09T02:49:48+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-11-09T09:49:09+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
          "product" : {
            "name" : "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
            "product_id" : "AppStream-9.4.0.Z.E4S",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:rhel_e4s:9.4::appstream"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Enterprise Linux"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "gdb-0:10.2-13.1.el9_4.src",
          "product" : {
            "name" : "gdb-0:10.2-13.1.el9_4.src",
            "product_id" : "gdb-0:10.2-13.1.el9_4.src",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb@10.2-13.1.el9_4?arch=src"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "src"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "gdb-0:10.2-13.1.el9_4.aarch64",
          "product" : {
            "name" : "gdb-0:10.2-13.1.el9_4.aarch64",
            "product_id" : "gdb-0:10.2-13.1.el9_4.aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb@10.2-13.1.el9_4?arch=aarch64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.aarch64",
          "product" : {
            "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.aarch64",
            "product_id" : "gdb-gdbserver-0:10.2-13.1.el9_4.aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-gdbserver@10.2-13.1.el9_4?arch=aarch64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-headless-0:10.2-13.1.el9_4.aarch64",
          "product" : {
            "name" : "gdb-headless-0:10.2-13.1.el9_4.aarch64",
            "product_id" : "gdb-headless-0:10.2-13.1.el9_4.aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-headless@10.2-13.1.el9_4?arch=aarch64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-minimal-0:10.2-13.1.el9_4.aarch64",
          "product" : {
            "name" : "gdb-minimal-0:10.2-13.1.el9_4.aarch64",
            "product_id" : "gdb-minimal-0:10.2-13.1.el9_4.aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-minimal@10.2-13.1.el9_4?arch=aarch64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debugsource-0:10.2-13.1.el9_4.aarch64",
          "product" : {
            "name" : "gdb-debugsource-0:10.2-13.1.el9_4.aarch64",
            "product_id" : "gdb-debugsource-0:10.2-13.1.el9_4.aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debugsource@10.2-13.1.el9_4?arch=aarch64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.aarch64",
          "product" : {
            "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.aarch64",
            "product_id" : "gdb-debuginfo-0:10.2-13.1.el9_4.aarch64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debuginfo@10.2-13.1.el9_4?arch=aarch64"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "aarch64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "gdb-0:10.2-13.1.el9_4.ppc64le",
          "product" : {
            "name" : "gdb-0:10.2-13.1.el9_4.ppc64le",
            "product_id" : "gdb-0:10.2-13.1.el9_4.ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb@10.2-13.1.el9_4?arch=ppc64le"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le",
          "product" : {
            "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le",
            "product_id" : "gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-gdbserver@10.2-13.1.el9_4?arch=ppc64le"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-headless-0:10.2-13.1.el9_4.ppc64le",
          "product" : {
            "name" : "gdb-headless-0:10.2-13.1.el9_4.ppc64le",
            "product_id" : "gdb-headless-0:10.2-13.1.el9_4.ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-headless@10.2-13.1.el9_4?arch=ppc64le"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-minimal-0:10.2-13.1.el9_4.ppc64le",
          "product" : {
            "name" : "gdb-minimal-0:10.2-13.1.el9_4.ppc64le",
            "product_id" : "gdb-minimal-0:10.2-13.1.el9_4.ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-minimal@10.2-13.1.el9_4?arch=ppc64le"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debugsource-0:10.2-13.1.el9_4.ppc64le",
          "product" : {
            "name" : "gdb-debugsource-0:10.2-13.1.el9_4.ppc64le",
            "product_id" : "gdb-debugsource-0:10.2-13.1.el9_4.ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debugsource@10.2-13.1.el9_4?arch=ppc64le"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le",
          "product" : {
            "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le",
            "product_id" : "gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debuginfo@10.2-13.1.el9_4?arch=ppc64le"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "ppc64le"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "gdb-0:10.2-13.1.el9_4.s390x",
          "product" : {
            "name" : "gdb-0:10.2-13.1.el9_4.s390x",
            "product_id" : "gdb-0:10.2-13.1.el9_4.s390x",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb@10.2-13.1.el9_4?arch=s390x"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.s390x",
          "product" : {
            "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.s390x",
            "product_id" : "gdb-gdbserver-0:10.2-13.1.el9_4.s390x",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-gdbserver@10.2-13.1.el9_4?arch=s390x"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-headless-0:10.2-13.1.el9_4.s390x",
          "product" : {
            "name" : "gdb-headless-0:10.2-13.1.el9_4.s390x",
            "product_id" : "gdb-headless-0:10.2-13.1.el9_4.s390x",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-headless@10.2-13.1.el9_4?arch=s390x"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-minimal-0:10.2-13.1.el9_4.s390x",
          "product" : {
            "name" : "gdb-minimal-0:10.2-13.1.el9_4.s390x",
            "product_id" : "gdb-minimal-0:10.2-13.1.el9_4.s390x",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-minimal@10.2-13.1.el9_4?arch=s390x"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debugsource-0:10.2-13.1.el9_4.s390x",
          "product" : {
            "name" : "gdb-debugsource-0:10.2-13.1.el9_4.s390x",
            "product_id" : "gdb-debugsource-0:10.2-13.1.el9_4.s390x",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debugsource@10.2-13.1.el9_4?arch=s390x"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.s390x",
          "product" : {
            "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.s390x",
            "product_id" : "gdb-debuginfo-0:10.2-13.1.el9_4.s390x",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debuginfo@10.2-13.1.el9_4?arch=s390x"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "s390x"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "gdb-0:10.2-13.1.el9_4.x86_64",
          "product" : {
            "name" : "gdb-0:10.2-13.1.el9_4.x86_64",
            "product_id" : "gdb-0:10.2-13.1.el9_4.x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb@10.2-13.1.el9_4?arch=x86_64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.x86_64",
          "product" : {
            "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.x86_64",
            "product_id" : "gdb-gdbserver-0:10.2-13.1.el9_4.x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-gdbserver@10.2-13.1.el9_4?arch=x86_64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-headless-0:10.2-13.1.el9_4.x86_64",
          "product" : {
            "name" : "gdb-headless-0:10.2-13.1.el9_4.x86_64",
            "product_id" : "gdb-headless-0:10.2-13.1.el9_4.x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-headless@10.2-13.1.el9_4?arch=x86_64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-minimal-0:10.2-13.1.el9_4.x86_64",
          "product" : {
            "name" : "gdb-minimal-0:10.2-13.1.el9_4.x86_64",
            "product_id" : "gdb-minimal-0:10.2-13.1.el9_4.x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-minimal@10.2-13.1.el9_4?arch=x86_64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debugsource-0:10.2-13.1.el9_4.x86_64",
          "product" : {
            "name" : "gdb-debugsource-0:10.2-13.1.el9_4.x86_64",
            "product_id" : "gdb-debugsource-0:10.2-13.1.el9_4.x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debugsource@10.2-13.1.el9_4?arch=x86_64"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.x86_64",
          "product" : {
            "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.x86_64",
            "product_id" : "gdb-debuginfo-0:10.2-13.1.el9_4.x86_64",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-debuginfo@10.2-13.1.el9_4?arch=x86_64"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "x86_64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "gdb-doc-0:10.2-13.1.el9_4.noarch",
          "product" : {
            "name" : "gdb-doc-0:10.2-13.1.el9_4.noarch",
            "product_id" : "gdb-doc-0:10.2-13.1.el9_4.noarch",
            "product_identification_helper" : {
              "purl" : "pkg:rpm/redhat/gdb-doc@10.2-13.1.el9_4?arch=noarch"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "noarch"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-0:10.2-13.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.aarch64"
      },
      "product_reference" : "gdb-0:10.2-13.1.el9_4.aarch64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-0:10.2-13.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.ppc64le"
      },
      "product_reference" : "gdb-0:10.2-13.1.el9_4.ppc64le",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-0:10.2-13.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.s390x"
      },
      "product_reference" : "gdb-0:10.2-13.1.el9_4.s390x",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-0:10.2-13.1.el9_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.src"
      },
      "product_reference" : "gdb-0:10.2-13.1.el9_4.src",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-0:10.2-13.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.x86_64"
      },
      "product_reference" : "gdb-0:10.2-13.1.el9_4.x86_64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.aarch64"
      },
      "product_reference" : "gdb-debuginfo-0:10.2-13.1.el9_4.aarch64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le"
      },
      "product_reference" : "gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.s390x"
      },
      "product_reference" : "gdb-debuginfo-0:10.2-13.1.el9_4.s390x",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debuginfo-0:10.2-13.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.x86_64"
      },
      "product_reference" : "gdb-debuginfo-0:10.2-13.1.el9_4.x86_64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debugsource-0:10.2-13.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.aarch64"
      },
      "product_reference" : "gdb-debugsource-0:10.2-13.1.el9_4.aarch64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debugsource-0:10.2-13.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.ppc64le"
      },
      "product_reference" : "gdb-debugsource-0:10.2-13.1.el9_4.ppc64le",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debugsource-0:10.2-13.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.s390x"
      },
      "product_reference" : "gdb-debugsource-0:10.2-13.1.el9_4.s390x",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-debugsource-0:10.2-13.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.x86_64"
      },
      "product_reference" : "gdb-debugsource-0:10.2-13.1.el9_4.x86_64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-doc-0:10.2-13.1.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-doc-0:10.2-13.1.el9_4.noarch"
      },
      "product_reference" : "gdb-doc-0:10.2-13.1.el9_4.noarch",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.aarch64"
      },
      "product_reference" : "gdb-gdbserver-0:10.2-13.1.el9_4.aarch64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le"
      },
      "product_reference" : "gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.s390x"
      },
      "product_reference" : "gdb-gdbserver-0:10.2-13.1.el9_4.s390x",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-gdbserver-0:10.2-13.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.x86_64"
      },
      "product_reference" : "gdb-gdbserver-0:10.2-13.1.el9_4.x86_64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-headless-0:10.2-13.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.aarch64"
      },
      "product_reference" : "gdb-headless-0:10.2-13.1.el9_4.aarch64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-headless-0:10.2-13.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.ppc64le"
      },
      "product_reference" : "gdb-headless-0:10.2-13.1.el9_4.ppc64le",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-headless-0:10.2-13.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.s390x"
      },
      "product_reference" : "gdb-headless-0:10.2-13.1.el9_4.s390x",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-headless-0:10.2-13.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.x86_64"
      },
      "product_reference" : "gdb-headless-0:10.2-13.1.el9_4.x86_64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-minimal-0:10.2-13.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.aarch64"
      },
      "product_reference" : "gdb-minimal-0:10.2-13.1.el9_4.aarch64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-minimal-0:10.2-13.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.ppc64le"
      },
      "product_reference" : "gdb-minimal-0:10.2-13.1.el9_4.ppc64le",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-minimal-0:10.2-13.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.s390x"
      },
      "product_reference" : "gdb-minimal-0:10.2-13.1.el9_4.s390x",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "gdb-minimal-0:10.2-13.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
        "product_id" : "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.x86_64"
      },
      "product_reference" : "gdb-minimal-0:10.2-13.1.el9_4.x86_64",
      "relates_to_product_reference" : "AppStream-9.4.0.Z.E4S"
    } ]
  },
  "vulnerabilities" : [ {
    "acknowledgments" : [ {
      "names" : [ "JD Marsters" ],
      "organization" : "Bhut Red"
    } ],
    "cve" : "CVE-2026-13732",
    "cwe" : {
      "id" : "CWE-787",
      "name" : "Out-of-bounds Write"
    },
    "discovery_date" : "2026-06-29T14:42:56.970000+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2494416"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in GDB's STABS debug format parser. The\nread_member_functions() function in gdb/stabsread.c contains a linked\nlist removal bug in the code that separates destructor and non-destructor\nmember functions of C++ classes. The bug causes the destructor entries to\nremain in the main function list while the list length counter is\ndecremented, resulting in an out-of-bounds write when the function list\nis copied to its final allocated array. An attacker can craft an ELF\nbinary with malicious .stab and .stabstr sections that triggers this\nout-of-bounds write when a user opens the file in GDB and performs any\nsymbol-inspection operation such as setting a breakpoint. The inferior\nprocess does not need to be executed. Under controlled conditions, this\nwas demonstrated to achieve execution of arbitrary commands within the\nGDB process.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This flaw affects the STABS debug format parser in GDB, which is present\nand active in all currently supported Red Hat product streams that ship\nGDB. The STABS format is a legacy debug information format predating DWARF\nthat GDB parses automatically from .stab/.stabstr ELF sections. While GCC\nremoved STABS emitting support in GCC 13 and GDB deprecated STABS parsing\nin GDB 17, all deployed GDB versions parse STABS data without user opt-in.\nAn attacker can embed STABS sections in any ELF binary, including one\ncompiled with DWARF debug information, and GDB will parse both. The\nvulnerability requires the user to open the crafted binary in GDB and\nissue a symbol-inspection command, which is normal GDB usage.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.src", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-doc-0:10.2-13.1.el9_4.noarch", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.x86_64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-13732"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2494416",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2494416"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-13732",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-13732"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-13732",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-13732"
    } ],
    "release_date" : "2026-08-06T00:00:00+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-11-09T02:49:48+00:00",
      "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
      "product_ids" : [ "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.src", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-doc-0:10.2-13.1.el9_4.noarch", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.x86_64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:96096"
    }, {
      "category" : "workaround",
      "details" : "The following practices would help for avoiding exposure and mitigate this\nflaw:\n- Do not open untrusted or unknown ELF binaries in GDB without first\n  stripping debug sections. Use `objcopy --remove-section=.stab\n  --remove-section=.stabstr <binary>` before debugging.\n- Use `readelf -S <binary> | grep stab` to check for the presence of\n  STABS sections before opening a binary in GDB. Legitimate modern\n  binaries use DWARF, not STABS.\n- Consider using LLDB or other debuggers that do not support STABS for\n  analysis of untrusted binaries.\n- For automated environments (CI, test farms) that invoke GDB on\n  potentially untrusted binaries, run GDB in a sandboxed or containerized\n  environment with restricted filesystem access.\n- GDB 17+ deprecates STABS support but still parses it. GDB 18 (expected\n  late 2026/2027) will remove STABS support entirely.\n- GCC removed STABS emitting in GCC 13 (2023), so legitimately compiled\n  binaries from recent GCC versions will not contain STABS data.",
      "product_ids" : [ "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.src", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-doc-0:10.2-13.1.el9_4.noarch", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.x86_64" ]
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "HIGH",
        "attackVector" : "LOCAL",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.0,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "HIGH",
        "integrityImpact" : "HIGH",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "REQUIRED",
        "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
        "version" : "3.1"
      },
      "products" : [ "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.src", "AppStream-9.4.0.Z.E4S:gdb-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debuginfo-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-debugsource-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-doc-0:10.2-13.1.el9_4.noarch", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-gdbserver-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-headless-0:10.2-13.1.el9_4.x86_64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.aarch64", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.ppc64le", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.s390x", "AppStream-9.4.0.Z.E4S:gdb-minimal-0:10.2-13.1.el9_4.x86_64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF"
  } ]
}