A heap out‑of‑bounds read occurs in the libdwarf debugging library when dwarf_debug_addr_table processes a .debug_addr section that contains a non‑zero starting offset. Because the offset is omitted during length validation, dwarf_debug_addr_by_index can read past the allocated buffer, exposing adjacent heap data or causing a crash. The flaw is rated CVSS 4.8, indicating a moderate risk to confidentiality, integrity, and availability.

The issue affects the libdwarf library, up to version 2.3.3, released by davea42. Applications that link against this library – such as debuggers, profilers, and other tools that parse DWARF debugging information – can process object files containing a malformed .debug_addr section. The vulnerability is inherent in the library’s implementation and not tied to a specific operating system or architecture, so any build that includes these versions is potentially impacted.

An attacker must supply a crafted object file with a non‑zero .debug_addr offset to a process that uses libdwarf. The read‑only nature of the flaw means there is no direct code execution path, but the exposed data can leak sensitive information and the failure can lead to a denial of service. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the realistic attack vector—loading malicious binaries—makes exploitation plausible in development and debugging environments.