CVE-2026-116732
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.
Risk Assessment
Heap memory data disclosure or crashes of object file analysis tools may occur. Organizations processing untrusted object files are exposed to information leakage and disruption.
Recommendation
Update libdwarf to a version newer than 2.3.3 if available, or apply the vendor patch. Restrict analysis of untrusted object files until updated.
Other vulnerabilities in libdwarf
See all- CVE-2016-5041High
The dwarf_macro5.c file in libdwarf before version 20160923 contains a vulnerability that allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry using DWARF5 without a DW_AT_name.
- CVE-2016-9276High
The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before version 20161124 allows remote attackers to cause a denial of service via an out-of-bounds read.
- CVE-2016-9275High
Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before version 20161124 can be exploited by remote attackers.
- CVE-2016-5044High
The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
- CVE-2016-5043High
The dwarf_dealloc function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
- CVE-2016-5042High
The dwarf_get_aranges_list function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
- CVE-2016-5040High
libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
- CVE-2016-5039High
The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
- CVE-2016-5038High
The dwarf_get_macro_startend_file function in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.
- CVE-2016-5036High
The dump_block function in print_sections.c in libdwarf before version 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
Original NVD description (English source)
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS