PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5042 Libdwarf Project CVE debrief

CVE-2016-5042 is a denial-of-service issue in libdwarf before 20160923. A crafted DWARF section can cause dwarf_get_aranges_list to loop indefinitely and crash, which makes the flaw relevant anywhere untrusted DWARF data is parsed. The NVD record rates it HIGH (CVSS 7.5) with network attack vector and no privileges or user interaction required.

Vendor
Libdwarf Project
Product
Libdwarf
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Teams that ship, embed, or depend on libdwarf should care most, especially distributors, build-tool maintainers, crash-analysis tooling, debuggers, and any service that parses DWARF content from untrusted or externally supplied files.

Technical summary

According to the NVD description, the vulnerable code path is dwarf_get_aranges_list in libdwarf versions before 20160923. A crafted DWARF section can trigger an infinite loop and crash, which NVD classifies as CWE-835 (Loop with Unreachable Exit Condition). The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely reachable availability impact without authentication or user interaction.

Defensive priority

High for any environment that processes untrusted DWARF input. The issue is pre-auth, remotely triggerable through input handling, and can fully disrupt availability by hanging or crashing the consumer.

Recommended defensive actions

  • Upgrade libdwarf to 20160923 or later, which is the version boundary identified in the NVD record.
  • Inventory applications, libraries, and build pipelines that depend on libdwarf so you can verify which components inherit the vulnerable version range.
  • Treat untrusted DWARF inputs as high-risk until patched; isolate or sandbox parsers where feasible to limit availability impact from malformed files.
  • Review vendor and distribution advisories linked from the oss-security references and the NVD entry for package-specific remediation guidance.

Evidence notes

NVD states that libdwarf before 20160923 is vulnerable and that dwarf_get_aranges_list can be driven into an infinite loop and crash by a crafted DWARF section. The record assigns CWE-835 and CVSS 7.5 HIGH with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The supplied references include oss-security posts dated 2016-05-24 and 2016-05-25, a Red Hat bug tracker entry, and a third-party advisory page. The CVE record in the supplied timeline was published on 2017-02-17.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5042 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5042

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5042 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5042

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.