CVE-2026-9502: GNU LibreDWG heap overflow in decompress_R2004_section

CVE-2026-9502 · Severity: medium · CVSS 5.3 · Published 2026-05-25

A vulnerability was found in GNU LibreDWG, a library used for reading and writing AutoCAD DWG files. An attacker could use a specially crafted file to cause a memory overflow, potentially leading to a program crash or unauthorized code execution. This issue primarily affects the 'dwgread' utility when processing certain types of compressed drawing data.

Technologies: Gnu LibreDWG. Vendors: Gnu.

Quick answers

Is CVE-2026-9502 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9502 being exploited in the wild.
How severe is CVE-2026-9502?
Medium severity, with a CVSS score of 5.3, published 25 May 2026.
Which products and versions are affected?
Gnu LibreDWG up to 0.14.
Is there a fix for CVE-2026-9502?
A patch was published on 2026-05-25: Patch commit e501cb9 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9502 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-9502?
Check whether you run Gnu LibreDWG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in GNU LibreDWG versions up to 0.14 within the decompress_R2004_section function in src/decode.c. The vulnerability is triggered during the processing of malformed DWG R2004 files using the dwgread utility. An attacker can achieve an out-of-bounds heap write by providing a crafted input file that bypasses insufficient bounds checking during decompression. This can lead to a denial of service (crash) or potentially arbitrary code execution. A patch has been released (commit e501cb9) which adds necessary validation for decompression bytes and offsets.

Affected products

  • GNU LibreDWG up to 0.14

Timeline

  • 2026-04-22: disclosed: Issue reported on GitHub by HackC0der
  • 2026-05-25: advisory: CVE-2026-9502 published
  • 2026-05-25: patched: Patch commit e501cb9 identified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.