Executive brief
A vulnerability exists in GNU LibreDWG, a library used for reading and writing CAD files. By providing a specially crafted DWG file, an attacker can cause the software to crash. This impact is limited to a denial-of-service on the local system where the file is processed, potentially disrupting operations or automated workflows that handle CAD data.
Technical details
A reachable assertion vulnerability exists in the decompress_R2004_section function within src/decode.c of GNU LibreDWG (up to version 0.14). The issue is triggered when the Dwgread Utility processes a malformed DWG R2004 file where internal decompression pointers (pos) are manipulated to be smaller than the expected offset (comp_offset). This violation of the assertion constraint `(long)pos >= (long)comp_offset` causes the program to abort. An attacker with local access can exploit this to cause a denial-of-service (crash). A patch (commit e501cb9) has been released to address this by adding proper bounds checking for decompression bytes and offsets.
Affected products
- GNU LibreDWG up to 0.14
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub by HackC0der
- 2026-05-25: advisory: NVD publication date
- 2026-05-25: patched: Patch commit e501cb9 identified
References
- https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_assert_fail_decompress_R2004_section.dwg
- https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9
- https://github.com/LibreDWG/libredwg/issues/1242
- https://vuldb.com/submit/814250
- https://vuldb.com/vuln/365483
- https://vuldb.com/vuln/365483/cti
- https://www.gnu.org/