Executive brief
GNU LibreDWG is a library used for reading and writing DWG files, which are the standard format for computer-aided design (CAD) software. A vulnerability in the library's decompression logic could allow a local user to cause a program crash by providing a specially crafted DWG file. This could lead to a denial-of-service condition for applications that rely on this library to process CAD data.
Technical details
An out-of-bounds read vulnerability exists in the read_2004_compressed_section function within src/decode.c of GNU LibreDWG. The issue stems from insufficient bounds checking during the decompression of R2004 DWG sections, where an integer overflow or improper size validation allows a read access beyond the allocated heap buffer. An attacker with local access can exploit this by providing a manipulated DWG file to the Dwgbmp utility or other applications using the library. This can result in a crash (denial of service). A patch (commit 8f03865) has been released to address the decompression overflow by adding explicit checks for address and size wrapping.
Affected products
- GNU LibreDWG up to 0.14
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub by HackC0der
- 2026-05-26: advisory: CVE-2026-9530 published
- 2026-05-26: patched: Patch commit 8f03865f37f5d4ffd616fef802acc980be54d300 identified
References
- https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap_oob_write_read_2004_compressed_section.dwg
- https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be54d300
- https://github.com/LibreDWG/libredwg/issues/1248
- https://vuldb.com/submit/814275
- https://vuldb.com/vuln/365549
- https://vuldb.com/vuln/365549/cti
- https://www.gnu.org/