{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116732", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T20:23:35.263Z", "datePublished": "2026-10-26T21:52:33.622Z", "dateUpdated": "2026-10-26T21:52:33.622Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:33.622Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table", "descriptions": [{"lang": "en", "value": "libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "davea42", "product": "libdwarf", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "2.3.3"}], "packageURL": "pkg:github/davea42/libdwarf-code", "repo": "https://github.com/davea42/libdwarf-code"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:libdwarf_project:libdwarf:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.3.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/davea42/libdwarf-code/issues/336", "tags": ["issue-tracking"], "name": "GitHub Issue #336"}, {"url": "https://github.com/davea42/libdwarf-code", "tags": ["product"]}, {"url": "https://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593", "tags": ["patch"]}, {"url": "https://github.com/davea42/libdwarf-code/blob/v2.3.3/src/lib/libdwarf/dwarf_debugaddr.c#L175-L216", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/libdwarf-debug-addr-table-section-offset-oob-read", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libdwarf-through-2.3.3-heap-out-of-bounds-read-via-dwarf-debug-addr-table"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/davea42/libdwarf-code", "product": "libdwarf", "repo": "https://github.com/davea42/libdwarf-code", "vendor": "davea42", "versions": [{"lessThanOrEqual": "2.3.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers."}], "id": "CVE-2026-116732", "lastModified": "2026-10-26T22:16:57.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-26T22:16:57.210", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/davea42/libdwarf-code"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/davea42/libdwarf-code/blob/v2.3.3/src/lib/libdwarf/dwarf_debugaddr.c#L175-L216"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/davea42/libdwarf-code/issues/336"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/libdwarf-debug-addr-table-section-offset-oob-read"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libdwarf-through-2.3.3-heap-out-of-bounds-read-via-dwarf-debug-addr-table"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "libdwarf: libdwarf: Denial of Service via out-of-bounds read in dwarf_debug_addr_table", "id": "2561463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561463"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in libdwarf. When parsing debug address tables, the library fails to properly account for starting offsets when verifying section length boundaries. An attacker could exploit this vulnerability by tricking a user or automated system into parsing a specially crafted object file, causing an out-of-bounds read past the allocated buffer. This flaw could lead to a Denial of Service (DoS) via an application crash or the unauthorized disclosure of adjacent memory contents."], "name": "CVE-2026-116732", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libdwarf", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libdwarf", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2026-10-26T21:52:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116732\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116732\nhttps://github.com/davea42/libdwarf-code\nhttps://github.com/davea42/libdwarf-code/blob/v2.3.3/src/lib/libdwarf/dwarf_debugaddr.c#L175-L216\nhttps://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593\nhttps://github.com/davea42/libdwarf-code/issues/336\nhttps://hackmd.io/@haindpwn/libdwarf-debug-addr-table-section-offset-oob-read\nhttps://www.vulncheck.com/advisories/libdwarf-through-2.3.3-heap-out-of-bounds-read-via-dwarf-debug-addr-table"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.3.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libdwarf", "source": "cna", "vendor": "davea42"}, "product": "libdwarf", "vendor": "libdwarf_project"}], "created": "2026-10-27T07:30:15.516729+00:00", "updated": "2026-10-27T09:15:18.343697+00:00", "vendors": ["libdwarf_project", "libdwarf_project$PRODUCT$libdwarf"]}