PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5043 Libdwarf Project CVE debrief

CVE-2016-5043 is a denial-of-service vulnerability in libdwarf’s dwarf_dealloc function. According to NVD, libdwarf versions before 20160923 are affected, and crafted DWARF input can trigger an out-of-bounds read that leads to a crash. The official NVD record was published on 2017-02-17 and later modified on 2026-05-13; the supplied references show vendor/third-party advisory activity in May 2016.

Vendor
Libdwarf Project
Product
CVE-2016-5043
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Teams that ship libdwarf or embed it in tools or services that parse untrusted DWARF data should treat this as a high-priority availability issue, especially where attacker-controlled files or artifacts can reach the parser.

Technical summary

NVD maps this issue to CWE-125 (out-of-bounds read) and rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerable range listed by NVD is libdwarf before 20160923. The supplied advisory references indicate the flaw is in dwarf_dealloc and that a crafted DWARF section can cause a crash, making the primary impact availability loss rather than data disclosure or code execution.

Defensive priority

High priority for any environment that processes externally supplied or otherwise untrusted DWARF content; lower urgency only if libdwarf is present but never exposed to attacker-controlled input.

Recommended defensive actions

  • Upgrade libdwarf to 20160923 or later, since NVD marks versions before 20160923 as vulnerable.
  • Inventory applications, libraries, and build or analysis tools that depend on libdwarf and verify whether they can process untrusted DWARF sections.
  • If immediate upgrading is not possible, restrict or sandbox the processing of untrusted DWARF files to reduce crash impact.
  • Monitor vendor and project advisories referenced in the record for any project-specific remediation guidance.
  • Treat repeated crashes in DWARF parsing paths as a security signal and validate inputs before they reach libdwarf where feasible.

Evidence notes

The supplied NVD record states: libdwarf before 20160923 is vulnerable; the issue is in dwarf_dealloc; a crafted DWARF section can cause an out-of-bounds read and crash; and the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Supporting references include the Openwall oss-security posts dated 2016-05-24 and 2016-05-25 and the prevanders.net dwarfbug advisory page. The CVE record was published on 2017-02-17 and modified on 2026-05-13; these dates describe record lifecycle, not the original vulnerability creation date.

Official resources

Publicly disclosed in the supplied record on 2017-02-17, with advisory and patch-related references dating to May 2016. The NVD record was later modified on 2026-05-13.