Live › vulnerability › CVE-2026-116732
Go to dashboardlibdwarf through 2.3.3 has a heap out-of-bounds read in dwarf_debug_addr_table() because it skips the table offset when validating the .debug_addr unit length. A crafted object file can leak adjacent heap bytes or crash any tool that parses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Teams that link or ship libdwarf 2.3.3 or earlier, or run tools that parse DWARF debug data from untrusted object files. Systems that only process their own trusted binaries are at much lower risk. unknown for the exact consumers the sources name.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.
This page as .md · .json · in your agent: get_signal("CVE-2026-116732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.