CVE-2026-116732: libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable() that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
An attacker must supply a crafted object file containing a .debug_addr unit with a non-zero offset table. Processing that file can cause dwarf_debug_addr_by_index() to read beyond its heap buffer.
Which systems are realistically exposed?
Systems are exposed when a local user or a user-interaction-driven workflow processes attacker-controlled object files using affected libdwarf versions through 2.3.3. The provided vector indicates local attack access and required user interaction.
What is the potential impact on an affected consumer?
The out-of-bounds read may disclose adjacent heap bytes or crash the consumer processing the crafted object file. The provided severity vector indicates low confidentiality and availability impact, with no integrity impact.
Is there a known remediation reference?
The provided references include an upstream commit, 71f04013ddc2a3c88b9e25a4162ee2824741b593, and issue 336 in the libdwarf-code repository. The data does not state which release first contains the fix.