CVE-2020-28163 Null dereference in n/a

Medium 6.5 Published 15 Apr 2023 Updated 6 Feb 2025

A NULL pointer dereference in libdwarf allows attackers to cause a denial of service via a malformed DWARF5 line-table header.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-28163?

CVE-2020-28163 is a medium-severity vulnerability in n/a, published on 15 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.

Weakness: CWE-476

Which versions are affected by CVE-2020-28163?

It affects 1 product.

Products include Libdwarf Project Libdwarf.

How do I fix CVE-2020-28163?

Upgrade to a fixed version.

Is CVE-2020-28163 being exploited?

There is no known exploitation of CVE-2020-28163 in the wild and no public exploit code.

Sources

Also known as AZL-33328, AZL-42090, DEBIAN-CVE-2020-28163, GHSA-7732-hqr2-cr7r, OESA-2022-1818, UBUNTU-CVE-2020-28163.