Bug 2561463 (CVE-2026-116732)

Summary: CVE-2026-116732 libdwarf: libdwarf: Denial of Service via out-of-bounds read in dwarf_debug_addr_table
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libdwarf. When parsing debug address tables, the library fails to properly account for starting offsets when verifying section length boundaries. An attacker could exploit this vulnerability by tricking a user or automated system into parsing a specially crafted object file, causing an out-of-bounds read past the allocated buffer. This flaw could lead to a Denial of Service (DoS) via an application crash or the unauthorized disclosure of adjacent memory contents.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-26 22:35:21 UTC 
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.