CVE-2026-9530: GNU LibreDWG out-of-bounds read in read_2004_compressed_section

CVE-2026-9530 · Severity: low · CVSS 3.3 · Published 2026-05-26

GNU LibreDWG is a library used for reading and writing DWG files, which are the standard format for computer-aided design (CAD) software. A vulnerability in the library's decompression logic could allow a local user to cause a program crash by providing a specially crafted DWG file. This could lead to a denial-of-service condition for applications that rely on this library to process CAD data.

Technologies: Gnu LibreDWG. Vendors: Gnu.

Quick answers

Is CVE-2026-9530 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9530 being exploited in the wild.
How severe is CVE-2026-9530?
Low severity, with a CVSS score of 3.3, published 26 May 2026.
Which products and versions are affected?
Gnu LibreDWG up to 0.14.
Is there a fix for CVE-2026-9530?
A patch was published on 2026-05-26: Patch commit 8f03865f37f5d4ffd616fef802acc980be54d300 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9530 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-9530?
Check whether you run Gnu LibreDWG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in the read_2004_compressed_section function within src/decode.c of GNU LibreDWG. The issue stems from insufficient bounds checking during the decompression of R2004 DWG sections, where an integer overflow or improper size validation allows a read access beyond the allocated heap buffer. An attacker with local access can exploit this by providing a manipulated DWG file to the Dwgbmp utility or other applications using the library. This can result in a crash (denial of service). A patch (commit 8f03865) has been released to address the decompression overflow by adding explicit checks for address and size wrapping.

Affected products

  • GNU LibreDWG up to 0.14

Timeline

  • 2026-04-22: disclosed: Issue reported on GitHub by HackC0der
  • 2026-05-26: advisory: CVE-2026-9530 published
  • 2026-05-26: patched: Patch commit 8f03865f37f5d4ffd616fef802acc980be54d300 identified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.