CVE-2026-9501: GNU LibreDWG reachable assertion in decompress_R2004_section

CVE-2026-9501 · Severity: low · CVSS 3.3 · Published 2026-05-25

A vulnerability exists in GNU LibreDWG, a library used for reading and writing CAD files. By providing a specially crafted DWG file, an attacker can cause the software to crash. This impact is limited to a denial-of-service on the local system where the file is processed, potentially disrupting operations or automated workflows that handle CAD data.

Technologies: Gnu LibreDWG. Vendors: Gnu.

Quick answers

Is CVE-2026-9501 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9501 being exploited in the wild.
How severe is CVE-2026-9501?
Low severity, with a CVSS score of 3.3, published 25 May 2026.
Which products and versions are affected?
Gnu LibreDWG up to 0.14.
Is there a fix for CVE-2026-9501?
A patch was published on 2026-05-25: Patch commit e501cb9 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9501 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-9501?
Check whether you run Gnu LibreDWG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reachable assertion vulnerability exists in the decompress_R2004_section function within src/decode.c of GNU LibreDWG (up to version 0.14). The issue is triggered when the Dwgread Utility processes a malformed DWG R2004 file where internal decompression pointers (pos) are manipulated to be smaller than the expected offset (comp_offset). This violation of the assertion constraint `(long)pos >= (long)comp_offset` causes the program to abort. An attacker with local access can exploit this to cause a denial-of-service (crash). A patch (commit e501cb9) has been released to address this by adding proper bounds checking for decompression bytes and offsets.

Affected products

  • GNU LibreDWG up to 0.14

Timeline

  • 2026-04-22: disclosed: Issue reported on GitHub by HackC0der
  • 2026-05-25: advisory: NVD publication date
  • 2026-05-25: patched: Patch commit e501cb9 identified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.