{"id":"CVE-2026-116732","kind":"vulnerability","aliases":["CVE-2026-116732"],"related":[],"title":"libdwarf: crafted object file reads past heap buffer in debug_addr","description":"libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.","summary":"libdwarf through 2.3.3 has a heap out-of-bounds read in dwarf_debug_addr_table() because it skips the table offset when validating the .debug_addr unit length. A crafted object file can leak adjacent heap bytes or crash any tool that parses it.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["binary-analysis","debuggers","libdwarf","package"],"not_affected_if":["trusted-inputs-only"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:28:05+00:00","updated_at":"2026-10-26T22:28:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:28:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"libdwarf: crafted object file reads past heap buffer in debug_addr","impact":"low","summary":"libdwarf through 2.3.3 has a heap out-of-bounds read in dwarf_debug_addr_table() because it skips the table offset when validating the .debug_addr unit length. A crafted object file can leak adjacent heap bytes or crash any tool that parses it.","category":"package","nicknames":[],"who_cares":["libdwarf","debuggers","binary-analysis"],"confidence":0.6,"needs_auth":"no","worst_case":"Heap bytes leak or the parsing process crashes.","analyst_note":"Check the NVD entry and the upstream libdwarf repository for a fixed version and whether the parser is reachable from network input.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["trusted-inputs-only"],"who_is_affected":"Teams that link or ship libdwarf 2.3.3 or earlier, or run tools that parse DWARF debug data from untrusted object files. Systems that only process their own trusted binaries are at much lower risk. unknown for the exact consumers the sources name.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000562,"input_tokens":3368,"output_tokens":451,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116732':14A,17A '-2026':13A,16A '2.3.3':26B,70C 'addr':11A,38B,50B,83C,94C,114C 'adjac':59B,124C 'analysi':20B 'attack':97C 'binari':19B 'binary-analysi':18B 'bound':33B,77C 'buffer':8A,122C 'byte':61B,126C 'caus':111C 'consum':129C 'contain':71C 'craft':2A,54B,101C 'crash':63B,128C 'cve':12A,15A 'debug':10A,37B,49B,82C,93C,113C 'debugg':21B 'disclos':123C 'dwarf':36B,81C,112C 'file':4A,56B,103C 'heap':7A,29B,60B,73C,121C,125C 'index':116C 'leak':58B 'length':52B,96C 'libdwarf':1A,22B,24B,68C 'non':107C 'non-zero':106C 'object':3A,55B,102C 'offset':45B,90C,109C 'omit':86C 'out-of-bound':30B,74C 'packag':23B 'pars':67B 'past':6A,119C 'read':5A,34B,78C,118C 'skip':42B 'start':89C 'suppli':99C 'tabl':39B,44B,84C,88C,110C 'tool':65B 'unit':51B,95C 'valid':47B,92C 'vulner':79C 'zero':108C","nicknames":[],"mitigations":[],"who_affected":"Teams that link or ship libdwarf 2.3.3 or earlier, or run tools that parse DWARF debug data from untrusted object files. Systems that only process their own trusted binaries are at much lower risk. unknown for the exact consumers the sources name.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116732","severity":null,"published_at":"2026-10-26T22:16:57+00:00","modified_at":"2026-10-26T22:16:57+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}