CVE-2026-116732

Name of the Vulnerable Software and Affected Versions libdwarf versions prior to 2.3.4

Description A heap out-of-bounds read occurs in the dwarf debug addr table() function when the table starting offset is omitted during the validation of the .debug addr unit length. An attacker can provide a specially crafted object file containing a non-zero offset table, which leads the dwarf debug addr by index() function to read beyond the heap buffer. This can result in the disclosure of adjacent heap bytes or cause the application to crash.

Recommendations Update libdwarf to version 2.3.4 or later.