Description
libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.
References (4)
Core 4
Core References
Issue Tracking, Permissions Required, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2026000
Third Party Advisory
https://www.prevanders.net/dwarfbug.html#DW202010-003
Scores
CVSS v3
6.5
EPSS
0.0048
EPSS Percentile
65.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-476
Status
published
Products (1)
libdwarf_project/libdwarf
< 2020-12-01
Published
Apr 16, 2023
Tracked Since
Feb 18, 2026