{"id":"CVE-2026-116732","title":"libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table","summary":"libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero …","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cvssSource":"cna","cwe":["CWE-125"],"vendor":"davea42","product":"libdwarf","affected":["libdwarf <= 2.3.3"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T21:52:33.622Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116732","references":[{"url":"https://github.com/davea42/libdwarf-code/issues/336","label":"GitHub Issue #336"},{"url":"https://github.com/davea42/libdwarf-code"},{"url":"https://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593"},{"url":"https://github.com/davea42/libdwarf-code/blob/v2.3.3/src/lib/libdwarf/dwarf_debugaddr.c#L175-L216"},{"url":"https://hackmd.io/@haindpwn/libdwarf-debug-addr-table-section-offset-oob-read"},{"url":"https://www.vulncheck.com/advisories/libdwarf-through-2.3.3-heap-out-of-bounds-read-via-dwarf-debug-addr-table","label":"VulnCheck Advisory: libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table"}],"tags":["cve.org"],"epss":0.00131,"epssPercentile":0.02701,"ingestedAt":"2026-10-27T16:11:59.123Z","slug":"CVE-2026-116732","body":"## Overview\n\nlibdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.\n\n## Affected\n\n- `libdwarf <= 2.3.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}