CVE-2026-13732 is a vulnerability in the GNU Debugger (GDB) affecting the STABS debug format parser. The flaw is a linked list removal bug in the read_member_functions() function in gdb/stabsread.c, which improperly handles destructor and non-destructor member functions of C++ classes. This results in destructor entries remaining in the main function list while the list length counter is decremented, causing an out-of-bounds write during the copying of the function list to its allocated array. An attacker can exploit this by crafting an ELF binary with malicious .stab and .stabstr sections. When a user opens this binary in GDB and performs any symbol-inspection command (e.g., setting a breakpoint), the out-of-bounds write is triggered. The inferior process does not need to be running for this to occur. Controlled exploitation has demonstrated arbitrary command execution within the GDB process. The vulnerability affects all currently supported Red Hat product streams shipping GDB, as STABS parsing is active by default. GDB 17 deprecated STABS parsing, and GDB 18 will remove it entirely. GCC removed STABS emitting support in GCC 13. Mitigations include avoiding opening untrusted ELF binaries with STABS sections in GDB, stripping debug sections before debugging, using alternative debuggers like LLDB, and sandboxing GDB in automated environments.

The vulnerability allows an attacker to cause an out-of-bounds write in the GDB process by opening a crafted ELF binary with malicious STABS debug sections and performing symbol inspection commands. This can lead to arbitrary command execution within the GDB process, compromising confidentiality, integrity, and availability of the debugging environment. The attack requires local user interaction (opening the binary in GDB and issuing commands) but does not require the inferior process to be running. The CVSS 3.1 score is 7.0 (medium severity) with high impact on confidentiality, integrity, and availability.

A fix is available as GDB 18 (expected late 2026/2027) will remove STABS support entirely. In the meantime, users should avoid opening untrusted or unknown ELF binaries in GDB without first stripping .stab and .stabstr sections using tools like `objcopy --remove-section=.stab --remove-section=.stabstr <binary>`. Users can check for STABS sections with `readelf -S <binary> | grep stab`. Consider using alternative debuggers such as LLDB that do not support STABS for untrusted binaries. For automated environments invoking GDB on untrusted binaries, run GDB in sandboxed or containerized environments with restricted filesystem access. Since GDB 17 deprecated STABS parsing but still parses it, upgrading to GDB 18 when available is recommended.