PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9558 Libdwarf Project CVE debrief

CVE-2016-9558 is a critical integer-overflow flaw in libdwarf’s signed LEB handling. According to NVD, a crafted bit pattern in a signed LEB number can trigger a "negation overflow" in libdwarf/dwarf_leb.c and dwarfdump/print_frames.c, with versions before 2016-11-24 considered vulnerable. NVD scores the issue 9.8 (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so teams that parse untrusted DWARF data should treat it as urgent to patch or remove exposure.

Vendor
Libdwarf Project
Product
Libdwarf
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-28
Original CVE updated
2026-05-13
Advisory published
2017-02-28
Advisory updated
2026-05-13

Who should care

Security teams, distro/package maintainers, and application owners that ship or embed libdwarf, especially software that processes untrusted binaries, debug symbols, crash dumps, or other DWARF-containing files.

Technical summary

The vulnerability is a signed LEB128 negation overflow affecting libdwarf’s dwarf_leb.c and dwarfdump/print_frames.c. The issue is classified by NVD as CWE-190 (integer overflow or wraparound). The affected version range in NVD ends before 2016-11-24. The published references include mailing list advisories and a vendor-linked fix discussion, which align with the library patch timeline in late 2016.

Defensive priority

Critical. NVD assigns a 9.8 severity with no privileges and no user interaction required in its vector, and the flaw affects core parsing logic in a library commonly used to inspect external data.

Recommended defensive actions

  • Upgrade libdwarf to a version released on or after 2016-11-24.
  • Inventory products and build outputs that bundle or statically link libdwarf, then verify the patched version is actually in use at runtime.
  • Treat untrusted DWARF-bearing files as high-risk inputs until affected deployments are patched.
  • If immediate upgrade is not possible, reduce exposure by limiting which systems can ingest external debug data and by isolating parsing workloads.
  • Validate vendor backports or downstream packages rather than relying only on upstream version labels.

Evidence notes

This debrief is based on the NVD CVE record and the references embedded in the CVE metadata. The core facts are: libdwarf before 2016-11-24 is vulnerable; the affected code paths are dwarf_leb.c and dwarfdump/print_frames.c; the weakness is described as a negation overflow in a signed LEB number; and NVD classifies it as CWE-190 with CVSS 3.1 9.8. The referenced advisory dates in November 2016 support the patch timeline, while the CVE publication date is 2017-02-28.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9558 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9558

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9558 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9558

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.