Executive brief
A vulnerability was found in GNU LibreDWG, a library used for reading and writing AutoCAD DWG files. An attacker could use a specially crafted file to cause a memory overflow, potentially leading to a program crash or unauthorized code execution. This issue primarily affects the 'dwgread' utility when processing certain types of compressed drawing data.
Technical details
A heap-based buffer overflow exists in GNU LibreDWG versions up to 0.14 within the decompress_R2004_section function in src/decode.c. The vulnerability is triggered during the processing of malformed DWG R2004 files using the dwgread utility. An attacker can achieve an out-of-bounds heap write by providing a crafted input file that bypasses insufficient bounds checking during decompression. This can lead to a denial of service (crash) or potentially arbitrary code execution. A patch has been released (commit e501cb9) which adds necessary validation for decompression bytes and offsets.
Affected products
- GNU LibreDWG up to 0.14
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub by HackC0der
- 2026-05-25: advisory: CVE-2026-9502 published
- 2026-05-25: patched: Patch commit e501cb9 identified
References
- https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_overflow_decompress_R2004_section.dwg
- https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be801c9
- https://github.com/LibreDWG/libredwg/issues/1243
- https://vuldb.com/submit/814259
- https://vuldb.com/vuln/365484
- https://vuldb.com/vuln/365484/cti
- https://www.gnu.org/