PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5042 Libdwarf Project CVE debrief

CVE-2016-5042 is a denial-of-service issue in libdwarf before 20160923. A crafted DWARF section can cause dwarf_get_aranges_list to loop indefinitely and crash, which makes the flaw relevant anywhere untrusted DWARF data is parsed. The NVD record rates it HIGH (CVSS 7.5) with network attack vector and no privileges or user interaction required.

Vendor
Libdwarf Project
Product
CVE-2016-5042
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Teams that ship, embed, or depend on libdwarf should care most, especially distributors, build-tool maintainers, crash-analysis tooling, debuggers, and any service that parses DWARF content from untrusted or externally supplied files.

Technical summary

According to the NVD description, the vulnerable code path is dwarf_get_aranges_list in libdwarf versions before 20160923. A crafted DWARF section can trigger an infinite loop and crash, which NVD classifies as CWE-835 (Loop with Unreachable Exit Condition). The published CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely reachable availability impact without authentication or user interaction.

Defensive priority

High for any environment that processes untrusted DWARF input. The issue is pre-auth, remotely triggerable through input handling, and can fully disrupt availability by hanging or crashing the consumer.

Recommended defensive actions

  • Upgrade libdwarf to 20160923 or later, which is the version boundary identified in the NVD record.
  • Inventory applications, libraries, and build pipelines that depend on libdwarf so you can verify which components inherit the vulnerable version range.
  • Treat untrusted DWARF inputs as high-risk until patched; isolate or sandbox parsers where feasible to limit availability impact from malformed files.
  • Review vendor and distribution advisories linked from the oss-security references and the NVD entry for package-specific remediation guidance.

Evidence notes

NVD states that libdwarf before 20160923 is vulnerable and that dwarf_get_aranges_list can be driven into an infinite loop and crash by a crafted DWARF section. The record assigns CWE-835 and CVSS 7.5 HIGH with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The supplied references include oss-security posts dated 2016-05-24 and 2016-05-25, a Red Hat bug tracker entry, and a third-party advisory page. The CVE record in the supplied timeline was published on 2017-02-17.

Official resources

Public discussion appears in oss-security references dated 2016-05-24 and 2016-05-25. The CVE record itself was published on 2017-02-17, and the supplied timeline shows that as the preferred disclosure date for this record.