# CVE-2026-9500: GNU LibreDWG heap buffer overflow in read_2004_compressed_section

Source: https://junglewise.ai/threats/cve-2026-9500-gnu-libredwg-heap-buffer-overflow-in-read-2004-compressed-section  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9500 · Severity: medium · CVSS 5.3 · Published 2026-05-25

GNU LibreDWG is a library used for reading and writing DWG files, which are standard files for computer-aided design (CAD) software. A vulnerability in the library's file-reading utility could allow a local user to crash the application or potentially execute unauthorized code by providing a specially crafted DWG file. This could lead to a loss of system stability or unauthorized access to data handled by the CAD software.

Technologies: [Gnu LibreDWG](https://junglewise.ai/threats/technologies/libredwg). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-9500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9500 being exploited in the wild.

**How severe is CVE-2026-9500?** Medium severity, with a CVSS score of 5.3, published 25 May 2026.

**Which products and versions are affected?** Gnu LibreDWG up to 0.14.

**Is there a fix for CVE-2026-9500?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9500 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-9500?** Check whether you run Gnu LibreDWG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in GNU LibreDWG up to version 0.14 within the read_2004_compressed_section function in src/decode.c. The vulnerability is triggered when the Dwgread Utility parses a maliciously crafted DWG R2004 file where the length of decoded data exceeds the capacity of a pre-allocated heap buffer. An attacker with local access can exploit this via a crafted file to cause a segmentation fault (SEGV) or potentially achieve arbitrary code execution. This issue appears to be an incomplete fix for previously reported vulnerabilities. As of the advisory date, the project has been informed but a formal patch has not been confirmed.

## Affected products

- GNU LibreDWG up to 0.14

## Timeline

- 2026-04-22: disclosed: Issue reported on GitHub repository
- 2026-05-25: advisory: VulDB published advisory
- 2026-05-25: other: CVE-2026-9500 published

## References

- [https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg](https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg)
- [https://github.com/LibreDWG/libredwg/issues/1241](https://github.com/LibreDWG/libredwg/issues/1241)
- [https://vuldb.com/submit/814248](https://vuldb.com/submit/814248)
- [https://vuldb.com/vuln/365482](https://vuldb.com/vuln/365482)
- [https://vuldb.com/vuln/365482/cti](https://vuldb.com/vuln/365482/cti)
- [https://www.gnu.org/](https://www.gnu.org/)

## Related threats

- [GNU LibreDWG out-of-bounds read in AcDs decoder](https://junglewise.ai/threats/cve-2026-111167-gnu-libredwg-through-0-14-8612-contains-a-global-out-of-bounds)
- [GNU libredwg null pointer dereference in LAYER encoding](https://junglewise.ai/threats/cve-2026-90622-gnu-libredwg-null-pointer-dereference-in-layer-encoding)
- [GNU LibreDWG heap overflow in decompress_R2004_section](https://junglewise.ai/threats/cve-2026-15520-gnu-libredwg-heap-overflow-in-decompress-r2004-section)
- [GNU LibreDWG null pointer dereference in dwg_next_entity](https://junglewise.ai/threats/cve-2026-15184-gnu-libredwg-null-pointer-dereference-in-dwg-next-entity)
- [GNU LibreDWG heap buffer overflow in BMP Image Handler](https://junglewise.ai/threats/cve-2026-15182-gnu-libredwg-heap-buffer-overflow-in-bmp-image-handler)