PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9500 GNU CVE debrief

A heap-based buffer overflow vulnerability exists in GNU LibreDWG versions up to 0.14, specifically within the `read_2004_compressed_section` function in `src/decode.c`. The vulnerability is triggered when processing malformed DWG files through the Dwgread Utility. The CVSS 4.0 score of 1.9 (LOW severity) reflects the local attack vector and low privileges required, with limited impacts on confidentiality, integrity, and availability. The exploit has been publicly disclosed, and a proof-of-concept file is available. The project maintainers were notified via GitHub issue but had not responded at the time of CVE publication. The vulnerability status in NVD is currently 'Deferred'.

Vendor
GNU
Product
LibreDWG
CVSS
LOW 1.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

Organizations using LibreDWG for DWG file processing in automated workflows, CAD data conversion pipelines, or document management systems. Security teams managing software supply chains with LibreDWG dependencies. Developers building applications that parse DWG files using LibreDWG libraries.

Technical summary

The vulnerability resides in the `read_2004_compressed_section` function within `src/decode.c` of GNU LibreDWG versions up to 0.14. A heap-based buffer overflow occurs when the Dwgread Utility processes a crafted DWG file, specifically affecting the decompression of 2004-format compressed sections. The attack requires local access and low privileges, with no user interaction needed. The vulnerability has been publicly disclosed with a proof-of-concept file available. The NVD status is 'Deferred', indicating the entry may require additional analysis or vendor coordination.

Defensive priority

LOW

Recommended defensive actions

  • Restrict execution of untrusted DWG files in LibreDWG Dwgread Utility until patched
  • Monitor GNU LibreDWG GitHub repository and official channels for security updates
  • Apply input validation and sandboxing for DWG file processing workflows
  • Review and update threat models for applications using LibreDWG for DWG file handling
  • Consider alternative DWG parsing libraries if vendor responsiveness is critical to security posture

Evidence notes

The vulnerability is documented in NVD with status 'Deferred'. Multiple source references confirm the affected function (`read_2004_compressed_section`), file (`src/decode.c`), and component (Dwgread Utility). CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow) are identified as relevant weakness classifications. The CVSS 4.0 vector confirms local attack vector, low attack complexity, low privileges required, and no user interaction needed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9500 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9500

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9500 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9500

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.