CVE-2026-116732
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset whe
CVSS
4.4
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 26, 2026 · Last modified: Oct 26, 2026 · CWE-125
Not enough EPSS history yet.
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.
- github.comhttps://github.com/davea42/libdwarf-code
- github.comhttps://github.com/davea42/libdwarf-code/blob/v2.3.3/src/lib/libdwarf/dwarf_debugaddr.c#L175-L216
- github.comhttps://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593
- github.comhttps://github.com/davea42/libdwarf-code/issues/336
- hackmd.iohttps://hackmd.io/@haindpwn/libdwarf-debug-addr-table-section-offset-oob-read
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libdwarf-through-2.3.3-heap-out-of-bounds-read-via-dwarf-debug-addr-table
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1167445.3 MED—
———ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.3hCVE-2026-1167366.1 MED—
———Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.3hCVE-2026-1167333.7 LOW—
———flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.3hCVE-2026-1167305.5 MED—
———Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.3hCVE-2026-1167293.3 LOW—
———libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.3hCVE-2026-1167285.5 MED—
———libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap block buffer, crashing the application.3h