---
id: CVE-2026-116732
title: libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
summary: >-
  libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in
  dwarf_debug_addr_table() that omits the table starting offset when validating
  .debug_addr unit length. Attackers can supply a crafted object file with a
  non-zero …
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-125
vendor: davea42
product: libdwarf
affected:
  - libdwarf <= 2.3.3
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T21:52:33.622Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116732'
references:
  - url: 'https://github.com/davea42/libdwarf-code/issues/336'
    label: 'GitHub Issue #336'
  - url: 'https://github.com/davea42/libdwarf-code'
  - url: >-
      https://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593
  - url: >-
      https://github.com/davea42/libdwarf-code/blob/v2.3.3/src/lib/libdwarf/dwarf_debugaddr.c#L175-L216
  - url: >-
      https://hackmd.io/@haindpwn/libdwarf-debug-addr-table-section-offset-oob-read
  - url: >-
      https://www.vulncheck.com/advisories/libdwarf-through-2.3.3-heap-out-of-bounds-read-via-dwarf-debug-addr-table
    label: >-
      VulnCheck Advisory: libdwarf through 2.3.3 Heap Out-of-Bounds Read via
      dwarf_debug_addr_table
tags:
  - cve.org
epss: 0.00131
epssPercentile: 0.02701
ingestedAt: '2026-10-27T16:11:59.123Z'
---

## Overview

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.

## Affected

- `libdwarf <= 2.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.