Executive brief
GNU LibreDWG is a library used for reading and writing DWG files, which are standard files for computer-aided design (CAD) software. A vulnerability in the library's file-reading utility could allow a local user to crash the application or potentially execute unauthorized code by providing a specially crafted DWG file. This could lead to a loss of system stability or unauthorized access to data handled by the CAD software.
Technical details
A heap-based buffer overflow exists in GNU LibreDWG up to version 0.14 within the read_2004_compressed_section function in src/decode.c. The vulnerability is triggered when the Dwgread Utility parses a maliciously crafted DWG R2004 file where the length of decoded data exceeds the capacity of a pre-allocated heap buffer. An attacker with local access can exploit this via a crafted file to cause a segmentation fault (SEGV) or potentially achieve arbitrary code execution. This issue appears to be an incomplete fix for previously reported vulnerabilities. As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- GNU LibreDWG up to 0.14
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub repository
- 2026-05-25: advisory: VulDB published advisory
- 2026-05-25: other: CVE-2026-9500 published