PatchSiren cyber security CVE debrief
CVE-2026-9500 GNU CVE debrief
A heap-based buffer overflow vulnerability exists in GNU LibreDWG versions up to 0.14, specifically within the `read_2004_compressed_section` function in `src/decode.c`. The vulnerability is triggered when processing malformed DWG files through the Dwgread Utility. The CVSS 4.0 score of 1.9 (LOW severity) reflects the local attack vector and low privileges required, with limited impacts on confidentiality, integrity, and availability. The exploit has been publicly disclosed, and a proof-of-concept file is available. The project maintainers were notified via GitHub issue but had not responded at the time of CVE publication. The vulnerability status in NVD is currently 'Deferred'.
- Vendor
- GNU
- Product
- LibreDWG
- CVSS
- LOW 1.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Organizations using LibreDWG for DWG file processing in automated workflows, CAD data conversion pipelines, or document management systems. Security teams managing software supply chains with LibreDWG dependencies. Developers building applications that parse DWG files using LibreDWG libraries.
Technical summary
The vulnerability resides in the `read_2004_compressed_section` function within `src/decode.c` of GNU LibreDWG versions up to 0.14. A heap-based buffer overflow occurs when the Dwgread Utility processes a crafted DWG file, specifically affecting the decompression of 2004-format compressed sections. The attack requires local access and low privileges, with no user interaction needed. The vulnerability has been publicly disclosed with a proof-of-concept file available. The NVD status is 'Deferred', indicating the entry may require additional analysis or vendor coordination.
Defensive priority
LOW
Recommended defensive actions
- Restrict execution of untrusted DWG files in LibreDWG Dwgread Utility until patched
- Monitor GNU LibreDWG GitHub repository and official channels for security updates
- Apply input validation and sandboxing for DWG file processing workflows
- Review and update threat models for applications using LibreDWG for DWG file handling
- Consider alternative DWG parsing libraries if vendor responsiveness is critical to security posture
Evidence notes
The vulnerability is documented in NVD with status 'Deferred'. Multiple source references confirm the affected function (`read_2004_compressed_section`), file (`src/decode.c`), and component (Dwgread Utility). CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow) are identified as relevant weakness classifications. The CVSS 4.0 vector confirms local attack vector, low attack complexity, low privileges required, and no user interaction needed.
Official resources
Public disclosure occurred on 2026-05-25 with CVE publication. A proof-of-concept file was published to GitHub. The vendor was notified through a GitHub issue report prior to disclosure but had not responded as of the CVE publication date.