Is CVE-2026-9500 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9500 being exploited in the wild.

How severe is CVE-2026-9500?

Medium severity, with a CVSS score of 5.3, published 25 May 2026.

Is there a fix for CVE-2026-9500?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9500 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-9500?

Check whether you run Gnu LibreDWG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9500: GNU LibreDWG heap buffer overflow in read_2004_compressed_section

CVE-2026-9500 · Severity: medium · CVSS 5.3 · Published 2026-05-25

GNU LibreDWG is a library used for reading and writing DWG files, which are standard files for computer-aided design (CAD) software. A vulnerability in the library's file-reading utility could allow a local user to crash the application or potentially execute unauthorized code by providing a specially crafted DWG file. This could lead to a loss of system stability or unauthorized access to data handled by the CAD software.

Technologies: Gnu LibreDWG. Vendors: Gnu.

Quick answers

Is CVE-2026-9500 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9500 being exploited in the wild.
How severe is CVE-2026-9500?: Medium severity, with a CVSS score of 5.3, published 25 May 2026.
Which products and versions are affected?: Gnu LibreDWG up to 0.14.
Is there a fix for CVE-2026-9500?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9500 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-9500?: Check whether you run Gnu LibreDWG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in GNU LibreDWG up to version 0.14 within the read_2004_compressed_section function in src/decode.c. The vulnerability is triggered when the Dwgread Utility parses a maliciously crafted DWG R2004 file where the length of decoded data exceeds the capacity of a pre-allocated heap buffer. An attacker with local access can exploit this via a crafted file to cause a segmentation fault (SEGV) or potentially achieve arbitrary code execution. This issue appears to be an incomplete fix for previously reported vulnerabilities. As of the advisory date, the project has been informed but a formal patch has not been confirmed.

Affected products

GNU LibreDWG up to 0.14

Timeline

2026-04-22: disclosed: Issue reported on GitHub repository
2026-05-25: advisory: VulDB published advisory
2026-05-25: other: CVE-2026-9500 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.