Heap Out-of-Bounds Read Vulnerability in libdwarf by davea42
CVE-2026-116732

4.8MEDIUM

Key Information:

Vendor

Davea42

Status
Libdwarf
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116732?

libdwarf through version 2.3.3 has a vulnerability that can be exploited through an improper handling of offset table lengths in the function dwarf_debug_addr_table(). When attackers craft a malicious object file with a non-zero offset table, it leads to dwarf_debug_addr_by_index() reading beyond the allocated heap buffer. This read can expose sensitive data from adjacent heap memory or could potentially cause the application to crash, leading to stability issues.

Affected Version(s)

libdwarf 0 <= 2.3.3

References

https://github.com/davea42/libdwarf-code/issues/336
issue-tracking
https://github.com/davea42/libdwarf-code
product
https://github.com/davea42/libdwarf-code/commit/71f04013d...
patch

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.