CVE-2026-116732

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex to read past the heap...