GDB EUVD-2026-68746

The user must open a specially crafted ELF binary directly in GDB and execute any symbol-inspection operation - for example, info functions, ptype, list, or setting a breakpoint; the inferior process itself does not need to be run. The binary must embed crafted .stab and .stabstr sections representing a C++ class with destructor member functions structured to trigger the linked-list length mismatch. GDB parses STABS sections automatically upon loading any ELF that contains them, so no additional user command is required beyond opening the file. Exploitation is bounded to the GDB process and does not inherently escalate beyond the privilege level of the user running GDB. Attack complexity is high (AC:H) because achieving reliable code execution requires controlled heap-layout conditions. No attacker privileges on the target system are needed; the attacker must only succeed in delivering the crafted binary to a location where a user will open it in GDB.

The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.0) accurately represents the attack model: the victim must deliberately open a crafted ELF locally in GDB, and crafting a reliably exploitable binary is technically complex due to heap-layout sensitivity. EPSS at 0.13% (3rd percentile) and SSVC exploitation status 'none' both confirm no observed in-the-wild abuse. However, SSVC also rates technical impact 'total,' and the description explicitly states arbitrary command execution within GDB was achieved under controlled conditions - meaning the theoretical scenario is well-understood. Even a mid-sized development team in legnica running automated GDB-based debug pipelines against untrusted or third-party binaries should treat this as a credible supply-chain threat in that specific context. The non-automatable SSVC designation reduces mass-exploitation likelihood significantly; risk is concentrated in developer workstations and CI/CD environments that open external ELF binaries without sandboxing. The absence from CISA KEV and low EPSS support deprioritization in non-development infrastructure.

An attacker crafts a malicious ELF binary with specially structured .stab and .stabstr sections representing a C++ class whose destructor entries trigger the linked-list removal bug in GDB's STABS parser. The binary is delivered to a developer or CI/CD system - for example, embedded in a dependency package or a submitted test artifact - and when the user runs gdb ./malicious and issues any symbol-inspection command such as info functions or break main, the out-of-bounds heap write corrupts GDB's internal state and achieves code execution as the user running GDB. No public exploit code is known at time of analysis, and reliable exploitation requires complex heap-layout engineering (AC:H).