Executive brief
A security vulnerability exists in GNU LibreDWG, a library used for reading and writing DWG files (AutoCAD drawings). An attacker could provide a specially crafted drawing file that causes the software to crash when processed. This results in a denial-of-service condition, potentially disrupting operations that rely on automated drawing conversions or processing.
Technical details
A NULL pointer dereference vulnerability exists in GNU LibreDWG up to version 0.14 within the dwg_next_entity function in src/decode.c (and dwg.c). The flaw is triggered during the processing of malformed DWG files, specifically when handling decompression overflows or entity traversal in the DWG File Handler. A local attacker can exploit this by providing a crafted DWG file to a utility using the library (such as dwg2SVG), causing a segmentation fault (SEGV) and application crash. A patch has been identified in commit 8f03865f37f5d4ffd616fef802acc980be54d300 which adds bounds checking for decompression sizes.
Affected products
- GNU LibreDWG up to 0.14
Timeline
- 2026-05-25: advisory: NVD publication date
- 2026-05-25: disclosed: Vulnerability details and exploit released to the public
References
- https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg
- https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be54d300
- https://github.com/LibreDWG/libredwg/issues/1245
- https://vuldb.com/submit/814260
- https://vuldb.com/vuln/365485
- https://vuldb.com/vuln/365485/cti
- https://www.gnu.org/